last executing test programs: 31.788555152s ago: executing program 2 (id=3008): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x1, 0x4, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_QTHRESH={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f00000004c0)={@val, @void, @eth={@multicast, @multicast, @val={@void, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x14, 0xe4, 0x0, 0x8, 0x11, 0x0, @empty, @loopback}}}}}}, 0x2a) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x14, r7, 0x301}, 0x14}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004840, 0x0, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r10, 0x0, 0x8008000000010, &(0x7f00000004c0)="17000000020001000003be8c5ee17688a20032000203000a0292000098fc5ad90a00bb6a880000d6c8db0000dba67e06020000e28900000200df018002000000fc0607bdff59100ac45761547a681f009cee4a5a2d8f89814bc6c252674f00c88ebb01005033bf79ac2dfc060115003901000000000000ea0000000000000800b59bd2b8e50ce5af649a702202ffff02dfccebf6ba000840024f0298e9e90554062a80e605007f71174aa951f3c63e5a1b47b6806323deb3", 0xb8) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8b0b, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x54, r4, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x7530, @local}}, {0x14, 0x2, @in={0x2, 0x7530, @remote}}}}]}]}, 0x54}}, 0x0) 27.499152326s ago: executing program 2 (id=3018): r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='[:/\x00\x00\x00\x00\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='addr\x00', &(0x7f0000000100)='::1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) unshare(0x68040000) ptrace(0x10, r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r3) wait4(0x0, 0x0, 0x1, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = eventfd2(0x74a6, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000280)="00ffffffffffffff", 0x8}], 0x1f) 25.351113243s ago: executing program 2 (id=3027): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x6, 0x371, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000001a40)=ANY=[@ANYBLOB], 0x6) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) mq_open(0x0, 0x800, 0x40, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000140)={0x1d, r4, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r3, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) sendmsg$kcm(r2, &(0x7f00000001c0)={0x0, 0x18, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001206", 0x2e}], 0x1}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r5 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0xc441) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000040)=0xfffffffe) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000080)) 22.10956596s ago: executing program 0 (id=3031): syz_open_dev$vim2m(0x0, 0x401, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000000)={0x1d, r2, 0x3}, 0x18) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl(r4, 0x4038ae7a, &(0x7f0000000200)=' \x00\x00\x00\x00\x00\x00@') 21.890163784s ago: executing program 2 (id=3032): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_buf(r0, 0x0, 0x1, &(0x7f0000000300)="800001000000000000000001", 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)='127.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)=ANY=[@ANYRES8]) r1 = accept$inet(r0, 0x0, 0x0) read(r1, &(0x7f0000000100), 0x4) read(r1, &(0x7f0000000304), 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$MEMREADOOB64(r4, 0x1269, &(0x7f00000000c0)={0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) socket$inet_sctp(0x2, 0x5, 0x84) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000900000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3fd, &(0x7f0000000500)=0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000690000/0x7000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000ff1000/0xc000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff3000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r9 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x4, 0x4001, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r9, 0x2219, 0x7721, 0x16, 0x0, 0x0) io_submit(r8, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f00000001c0)='m', 0xfdfe, 0x400000000000000}]) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000c40)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8}], 0x1}, 0x40080) write(r10, &(0x7f0000000780)="023f75e362cfc445c5dabb87c8df76a4d7b08934df0186d50a91fc9fa5da055d821e6438969182edb9383fd9f60b8e21c2ef0cb6738dc9ef651af5ac1ba50b5d0caa7b1f5c5ce5cf976c43ff545b734d69c7a2c5af50435f44bc1fdf2523a9b6cd759896a0a507ecb9eaa9f0abb33b6e24f9e7b046af77a1978f3847ff832277dae19d1a98ffbde52e49", 0x8a) 21.574390739s ago: executing program 0 (id=3033): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d23396", 0x10, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0xfffc, 0xfffffff9, 0x6}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000000)=@ethtool_link_settings={0x4d, 0x2, 0xf, 0x80, 0x0, 0x4, 0x0, 0x0, 0xfe, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000300), &(0x7f0000000000)=""/10, 0x2}, 0x20) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000200fc0000000800050064000000050006"], 0x44}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r4, 0xc0a85322, &(0x7f0000000380)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x4058534c, &(0x7f0000000140)={0xd6, 0x6, 0x0, 0x8, 0x6000000, 0x7fff}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="6664adb8f2c2364ccca57e2fe6bd9b2df54650e23450c4b1158bd3a6803b7586fa", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000007,\x00']) futex(0x0, 0xb, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r8, 0x0, r9, 0x0, 0xf3a, 0x0) write(r6, &(0x7f0000000240)="94", 0x1) tee(r5, r9, 0x8f5, 0x100000000000000) write(r7, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4000) mbind(&(0x7f0000a74000/0x1000)=nil, 0x1000, 0x1, 0x0, 0x2, 0x1) futex(&(0x7f0000000000), 0x8c, 0x1, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r10, &(0x7f0000003480)={0x2020}, 0x2020) 20.790414325s ago: executing program 2 (id=3036): r0 = socket(0x2b, 0x4, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x2010, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r2, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) close(r2) write(r1, &(0x7f0000000000)='3', 0x4e) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', r4, &(0x7f00000003c0)='./sys/devices/system/machinecheck/machinecheck0/ignore_ce\x00', 0x10) ioctl$SIOCPNENABLEPIPE(r4, 0x89ed, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001a80)=@newtaction={0x60, 0x30, 0xffff, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x9, 0xff, 0x2000000e, 0x8, 0x2}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x402640, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f00000004c0)={r0, &(0x7f00000002c0)='\\\x00', 0x200, &(0x7f0000000340)={@_ha_fsid={[0x3095, 0x8]}, {0x7, 0x0, 0x6, 0x8000000000000001}}, 0x7, &(0x7f0000000440)={@_ha_fsid}, &(0x7f0000000480)=0x4}) sendmsg$RDMA_NLDEV_CMD_GET(r8, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)=ANY=[@ANYBLOB="510000000114000225bd7000fedbdf250800010000000000080001000100000037c88e60220000000800010000000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x400c015) openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x400, 0x0) 20.515715238s ago: executing program 0 (id=3038): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000000280)=0x700) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xff}}, 'vcan0\x00'}) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/12/smp_affinity\x00', 0x1, 0x0) write$binfmt_misc(r3, &(0x7f0000000340)="55f7ee03ccaa274c40812dbb2c45", 0xe) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x42100) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r5, 0x80605414, 0x0) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$FIONCLEX(r4, 0x5450) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xc000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x121080) ioctl$I2C_FUNCS(r8, 0x705, &(0x7f0000000440)=0x6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x19, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000240)={[0x10800000007, 0x2, 0xa, 0x3ff, 0x6, 0x10003, 0x1041, 0x14, 0x9, 0x40000ca, 0xc29, 0xffffffff, 0x4000000000000004, 0x5, 0x0, 0x4], 0xb000, 0x350057}) mprotect(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0001}]}) close_range(r9, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000700000008000500", @ANYRES32=r10], 0x64}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e23, 0x1, @empty, 0x9d4}}, 0x8, 0x200, 0x1, 0xf395, 0x31, 0x10000000, 0x8}, &(0x7f0000000500)=0x9c) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000540)=@assoc_value={r12, 0xb}, 0x8) 19.612640761s ago: executing program 2 (id=3043): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x500, 0x0) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/kvm/mmu_shadow_zapped\x00', 0x0, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r4, 0x3b83, &(0x7f0000000100)={0x28, 0x10000, 0x0, 0x0, 0xcaa29, 0x6f77, 0x9, 0x22c37d}) read(r3, 0x0, 0x0) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r0) r6 = socket$xdp(0x2c, 0x3, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x18, 0x3a, 0x0, @dev={0xfe, 0x80, '\x00', 0xd}, @loopback, {[], @mld={0x82, 0x0, 0x0, 0xb, 0xc036, @remote}}}}}}, 0x0) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000000)=0x94b, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000440)={@broadcast, @random="5aeadd61229e", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x38, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x29}}, @mcast2, {[], @time_exceed={0x4, 0x2, 0x0, 0x9, '\x00', {0x0, 0x6, "f99063", 0x800, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], "af34000000000000"}}}}}}}, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000000)={&(0x7f0000000000), 0x1000, 0x800}, 0x20) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000002540)={&(0x7f0000003000)={[{&(0x7f0000001440)="02772a96bfaed7bfe0de12fd4ea9e9f5d27cfe015e9046cff679ab95696775e517e4ae800a935df2cd937e0965d791bb28778dce4120f36694539986a3b4bb5c18462923cf0b7b5b82ab54cfed7be550130bb2a7a91090a1790653b4359c49c350d0786de7ac9699c5a2b63b0cbad03092e73402d74c79e5383ad3a28812a0d80935ec08cba33d391da94df232a64ca00954aba43f8c3d53e57da4235f993498bbc0b7ffdde8c928ba9c015284e624f5847e6847409e944f91d2acbd3c68d3bdb595a9d1f71fa0a3dea49f78b4d190edff916f907cc4809890e7ef8f480e292eea4eb7a5103a5ca0528d361e480b1bd47fd947485dc4689ed61369f246cc17ece33f00c8ffe9fd901058532225c0d2df28ad7aa102cb149d12652f6c45648906199a2da3ecd6ffc9d07badaf637f39f59f234cf11d6f53edd79bb6f7bb2f8778c8ca10557e78815d971201d1363a387ccd00808a53342dd2704da79b87283990144e4714a1a23a422979c4b857b41ce49d4b01893830a09ce06787e75c29abd94af3108c53ffd64af38007427d665fdaa3a342446bb2a5925bfbbd170a7d964c8e818a5bab284bec5073e3cbc5ff84a17808d729212a9e474ae05b53f63d78cb9144c99637faaecbe5d2719ca76e50ebea7017cb52bc4f9b55fbf1586ac4e24bfec07b05b6f58b3c513362fc5627016ea2ebc0417eebdf4bd791060298292f6da4b7ade33590239aace91ffcc0b713c1cb4e947da25f173b94f95f18f66966df544b07d57dc27598bb770fcc1441d73f023819f5e5ab90d4163c6ae1b399033e3b381e08aa1efe594d244e312e04c22b5021dd54b143bb6c2270c164d0f1533af3f89640392bf30db0824af545711e0b0d1250a6a5e87231bcd50f2d20cd9934c84ccb0c1c95226e305f70edbeede5d351d8c251ad47666a9e8c07aaf739c27821cdc7114fe70d283eb0caab92efcea9584129346b3bcac5f3a32819670fc3d571f176bfd6b7c364e9011b680dc76e0ab3c546a0e2b0dfe706b974faae48465a20d778e36f90f66c45a3ee24ffb765ec9fa964bb91f34970baf556c2968abfbc2e5aeb9d2a48139ae8d8e38ae9bc1fb4eb0cfeee81c9dfb56c58a65b649474c95674208b9d4303f6df337113ea86576670c4dc8499fe5b057faa0758db3e70c18dbadd2a2f414ce3614d5ab3ecce6d831783807bcd12bdd46cb71794fe45f1a66a51e9dc3eafd4ccc57692e725a3d17be86e99980c4dc80672e0ef905ace7838a63bb63c7ca4b142ac698473ad5ac33957153de87b7083fa09e6562c1c4666ae9e612d40ca2ea4fd7d9f5e3de530b59078a1581b467cb97e75e54b52d3cc80e2f8a056cbd6a57ef43fb75c7fcd84f36120737aaeef7654a3cb71e97791b8a0b8fec35299a0b8fbd3680dfcf2600d22eafe621be4951422516702baf8a19504f46e290510e3dde099e49dc01bc21a2c38c506830cc8c9905e7a442bdac86188b0f8b5a236e83095c587def54ec9b5805f396e407248ecde59f2d18cdcd8ccd15526ecc99279253bac38e2a75d7fdcac13ad4efc5c160e8d2474684ff3dc1c3c113bc566b50cf0ad69be8bb4d84c1206bcf5ffcf8c3b56ea68c6248e89508c8325c7f043175a81e6837d82ac04d2310d7b70c0309be80d78c87f174a370cb098fe71761de7077ac9d01f57188431df71b7cf7bb6de84859bc76e3e042f2f386aa9880ee29146398a6900bfdb90c3f2d88ef54846fbb348d63ac94ee57d4d67b8bcadec7f974412e484033b5ea765778cf190c01500e00723995f6fb7f32b228643b7c5746acba23d610232ae4de86f3f5c35975e704baea2d33d0cb6282b86f09d293bc559c38c2d7a5f96ac39a1376c3c763f5685e6c8179c7efcd8a3961010a036b151b0033f5924fce0f58b933eb971ff8ba85a86c296f5a18fa53ee73f99da6d98ec26a529a976fc58f238b0fcd0281e3ab3e87feca619c265e6196dc0db5c31158b6cd03f4dca9c3738790fa7f2f4e9a374dd15b586662e84db884242f39a354deb5fdd35f0da15d9ca37067a34b081f2f2eafac44e358837eb16c92286dc08b958f48d5852613d012529d200b3531722a7eedf0f3ffd49f04f355f3c2a7ecaab85c39f658b83a34ec192d710a010d1ead4fb07c70ded6b59687bedcb252a53be01df2f8405a138bdad9d23e1b2fee510e0bbe78521b2464d848119695237fc8b623516caa2e18a9a8c84ad1ee71111a3eab5d0182ff8eb490e3df142ef6a00c9d8f73de19b80a97aef39b1b9fb0e035195e7c42691c127b7d897209832279b049b8b38665c7a9262ab675913775ee0f1a4b4ef358823ba2833bb9a39adc8ddc1709b1915b12ef8b7b3b0cfed2014cb7288d459ae983f9c28141046e1fd19e0b336ee025162bf48d6e15b64ee55a0e932aa016e6b59654265cda753438c6f75e8a7ffdba72e0dc13c0f3728d0df7bdcd846944b78c11886cc8a76b656267a445b39016fc593bd7ff6f422676db79a3ffb476dd1182e0a9bee86ce42700f1187efd2dc75d1982c4583de995a5f82f5a6099c8565ca4c74e03cedddd58e8a3b0dc7a127f571ef217221de4873f1f747804386167ded046b307017daeb65da94fd903b2fc7b59c32344af073b57e34802a16c9b9fe617afbef616e1a5b38fcb2d478bc618a028793f3d504c1075ff467bef975e739db3a9a87498ad6ee49b1a19aa54b68401db0e8ba6661d5f2067623073446576431b1302bd15b4ac1df8e56c51d228b13b2d3942091b4a84eff52fda5880dbcb09846034eee15c99afdc8c339d5594f2a17e156be359e7ea4246baaa929d127eb82c1f072a8567cf8032c1191674516d398435e50be459a1ea84a101eb8384fb7f62cc2425a7e36645a08ece82a5b24a3c1f244e466258d487620900379dacca0c40621643099a8bce13c8baffefe2adeb82c89750566c0de89e2a25db4b58036346e3912c2573d849d70c2f20507267b0971a7baf202efeb8b76ab7fd28c42f7d4a3078c9cc5de3fdba8873e2cf6f93e0302b3b99dfe92fb0e36e2c2b533a3e6abb4cee177571e2a5997f1f3212e8cb1dcbcc53414cd37f4d55ac245855a1b8070159b31c9a45317e27076ede02b8439ffb15baa1a0a0c03bcee92a85b04e7b1a573fa4bf929d4408126ee02401446230d13d966f9556edd125ca9b4de894985b33b9b7ef1f038b751ed496c1ac5ea3c9db1b9a82659256a1817f883193b9ec56bd8df8764cf8c7b1cc22bc354a63ba019b5759824b5e325bafbf11f922bc990fc2735a9b10d79d0d4e69679ab78b674cfd1c85d7368c1789b5d1964f69249a2a0d1b256007c1c16040426fd97b62546c9f2ee2f06e4bfaa3b38afbd3973d83ea9130c9540c04460fa9dfd9b52ae01139001e88a6b361f3ec2d04f90dbb25cc48a77e2efa67ad421864a44aa64dd2814d6cd27efbfbfcb0f21a017357a37ac7ab647ed354befb99dce6a585380b422d11da34ae5223d59d14b639b8db79a2ae5b4fba1bc19356644006fc20a64bc8ee9383866cf50ba303435e9e5e778284e215da79b22f0cf43b88fb3f64fff47ca66359bf601e0c6e33e2d75f47eb272291ceecddc8b03701a04f86fdd15a5a54f5198fff8713b0d1e8bce1967b4d01157d4e71d0463aded50e0ee7e34c678e256e17153e56a482fb29d3b7f90bf4ad3643835bf4370b3f061c5a5acee80a90d65e2e5fe21709c9a9ac5601422df36e76e1b728b3449ae3d4919b22820da185e179a31edf772bbcd09bb818aa177751f4fc51ab165192413f2017b4e804e8f059114f014ede85566585d0329a7f960e5135d830fdfe947fd446980e4931d3ca0b2b5eb5d02df373bda45147aea2ae0c2acf7742530e6ab017c347ad3a2c783b0d82ee867b43ebbab31757be332783e07a3399d0719de266ee48acc26dd061605da2ade22dcb0f028c4191352f87caa1bc83a7bd1ccbfa534dec5afa462d5a936ab29cd4978f6951074d7f38b17391a8d56f4c4934bf19a104d9fb2bc1ca8c8173565e7c083feb91ccb623d9732134fc167091d0cd2d75b80e7038a85ebaa84350f01eaef6769c9d95a7add9d3008bc47d2d1bac48586402816b6878bd77786728887d0e72458ff91620315a347b306e2ee14c16697a980349ddea217034df02c931e97e20ed982e68b8e5e95b276e0d9a731e5a26aee65727c5d622a273eb0852bdd50713fe6ce06a87fa130a1cd9114df5cc8f8f342a07c9bd4e212163cd8e1d63cf85db09b1dcb403e05ca637d7adf7463a6cb565ab990cdb7bfc08d9655671c7a07c5f6d99ef17e062be35c573dc27f9072cb57279fa9c693836ba57931ccece5ddc5b6eefcfe052a294a31196fd41c5f246f06922bfc557446b5957bf6a9768f2d2b639caccb44828897a494d01738920d83e274cdfcd55a1633e6325a19279da5130eb29e3ebf15797f039e1dae51fecfc67a6adae4de53e9bbb3d6ad0c986bd1b336c1935eb3e5d0ef3fa888dd466fa5d54ad2464f7250814a6abf955cc35f67a7d0dfd932d1d95d32d74e205465c8dedb53c2c9e3ab303a4d155b8446bb8d3006130689ff37dc71840a5d251ea09e6984baed2317205ba8c10ab92ba8af1149c06aaf10a9381c5f84898c5b28a7f0ed5e76d4ae0fccbb8c8518f3830bf3647793b3acc012eed1e066b9ee7b69c49f89e6ae3ed6e25bfeeabe0199f8f0776bed74ab8f6379efda0e6e95853cddc3610a0eac61f0793380fdcb12b5ca480204c6d9adc23d5c71d058792ed48399e21496460a890a905610a9659dba9aaa4116b5e933d39d9216e8ac0fb0904d2254a36e71d2b4e67c046ebadb54add5c8d71f4848bd107a4ebbd1de00f4ce6304005dff1ca5d0d1e1fd66a2ec9707bfbd432e2f28d303ef12b2afe8b45db980fd66e06c397e2b60c0365b5f49dd5b8330564fb745451c9c245d89ce6b55d2a356177652b68d542fa0b6bf6748fc90cfada671858dddba7f861b36ffef75109b19bc7077e169eae3ae87da3463d17ab8ee473fd3fc37f8ba399e2a513ffcf8cc2b3dd907e182191e3d6f50fb07a56a73a7461411c8cc7c457e62fc2f8c8b93aed84c4063e1b74b0bfe4ed2ed24aa6e671219bcbebba9ca2c30b8384a60498c943eaba8cf1d3367520a143091e610843b9f13ead98d1fa87b899781f406bddb7d193bb3e20d11d27d63259a535288e15c3a0832682560cfb3eca62db8ebf5c481f128fc8e4fdae80ccfc30287747cea77da942e8962b9519c166486fd4781681ef85050b1119da100c46cc9e3cee7b8d3a89b0bf37bec1c6a1fd5afda62e7fa0ad42e261531b01f017a784744814103df3cc2e82a887720b2e38586aea7f0846e161d4b47d0602409f2d79d8069af0b6d5f79241748c0421db587e50c0bb1f1ce1eb7251a26be01dc666ad877669a803f88b86ddf1be80b185619e0d50565cb881445af99ccb6f09466d90bbe3945b63b5de99601ce90c7f4431bae5677b006960f03061a348f57daf9ec45be6254cd9788a3223c83caf47940dbf5974bd48ced003f9dd088ccf68bd688813ff69fb5cbf58529288d9c744c6c3e3308e8d8c5be209b134015875048e66ca3f9cba1bf0c83f6efd53c1118457da01b7bb548ff8459ee2b7493ecc4e1f2260eec9b011b13600e0639e5e53a3317ac19d8935e35da274b097dc62fd2986e8d8f8b2f0fbcc2e1f4776fd2412b6ebc4b5748384fa408e099c105cf594801b049287346aeb042b1444c741ad44f36bca2c051de223009d43fe65d957421035410e72ee967", 0x1000, 0x3}, {&(0x7f0000002440)="ef3844cd393dd756fe0b246d6f17abcf158129d19635792e86cb3d77863677af9cd8fb334ae1d0f8cd61776bb974757b1d4f1128f169f4de4ed7", 0x3a, 0x2}, {&(0x7f0000002480)="bb5b20f8d461aa04be9ce832e991d7fd3db54833341551659d041174eed3b70dcb894d8d1835e90adfd8a8739b3e2b57b35740d7d7dd59cee9dfb480001fb704435735feb72cc50c09a364235aae32028b39849f9844c8b9943c684d78741b14a9767f354e14f1134ab8629e59b1ff6c6174bb6fe25ab42ede96e2bf3f9c467b80f490ae", 0x84, 0x3}]}, 0x3, 0x2, 0x7}, 0x1) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001000)=0x10, 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000001200)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000001300)=0x10, 0x4) bind$xdp(r6, &(0x7f0000001400)={0x2c, 0x0, 0x1, 0x0, 0x0}, 0x10) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000200)=0x2000, 0x4) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='p\x00\x00M', @ANYRES16=r5, @ANYBLOB="000329bd7000fedbdf250800000005000500ff0000000800030000000000080002000400000004000180080003000500000008000300020000003000018014000400fc0100000000000000000000000000010800060011000000050002001000000008000300ac1e0101"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x84) 19.350858396s ago: executing program 0 (id=3045): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='dyn']) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) r0 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x80000, 0x0) mount$bind(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x40000, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000080)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x9, 0x3ff, {{0x7, 0x4, 0x3, 0x6, 0x1c, 0x65, 0x0, 0x5, 0x4, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x82, 0x5, "b6e088"}]}}}}}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={&(0x7f0000000040), 0xc, &(0x7f0000000380)={&(0x7f0000000300)=@getchain={0x54, 0x66, 0x400, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x1, 0xfff0}, {0xc, 0xffff}, {0x5}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xfff}, {0x8, 0xb, 0xfffffff6}, {0x8}, {0x8, 0xb, 0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4008080) 16.926860537s ago: executing program 0 (id=3048): ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x8, 0x16, &(0x7f0000000340)="d3c4f7e5de1029f7c9d49f8ae23bad4c0699ef9bbe32c2d6888de5b064aa94d536c7f837593c4363a0964c3fc548b5d5ff6fb603cf9f3fefd2f60b3d0ba2f24a555d6e0616f58796f2431ae3be01de96c383add6f32f28067c022e846099d07b66d0aec40d14def5d5aa5d8f3e37a6712de9ddaa02027aec24849a1b5b403833fc9e70687141543839be295074f592ad680689b9c98c8fe495f197cadc9250ebb4a5ec065ac0e75a33060f190290603121098dac7f091395998c094b1acd3d465d9ceb5b61d895461cce67a375338559bdf477074738e4cf16b41480c6031238e9f876699e5706891996b36372dc71b942cd9dff7a8ba64cd5331302c7b92d82659ff623b915fdf85df3124189ac720b4d3cf7bf6e1a55c8d39db0c389bbbddf1e294a603260798abd52ec4f5c77bc416465027db99368b38670204b0762077a25d82724fc01ab531a6fcbf5c00c67f87a5bb98f95306b1d99df10abbe6cca16e98b6a8b5dec0af6f21f1f29bb0b4416bdbad80c2d9ec6fd41140a15a9a3a205364c71ff1fd23149c54bf86f725d7ddac71b50f99a25e66a7038fa229fc0211520b7470d011e7b233fde3543702db126567a34bd35aa4a59a05a83760ebe49eb4b9364ba367a62b820eaa487f772a9a0898ab5040d72c4c41a5a7269cd7efdfe731f80697a3da25c6c24619630fc91581b9b5ab8e2ebe35e8b1d1fd8f4cfca4238836c0403d470632503436325b063ddab48e820f81f4043000dd6fa9c60be47689edf59d369114323144f0cc9588148ec4d58e58e9f119926e30c358f6527eb745599b65b88b6062bd5b18140c7d3d64a3e43ed3abf5c49105d069a1f36ac3abd7141979fbf2735f13869f3e76bb8d1b0d92728be1fc39283d7d083d450e07adeb5f23148700266948d54cf5e5e79a274ed4f419e5fc10340d088031265a7d237362166ef22bcd9ae8b1bb8237d57e499cd8d3a3c2924f7266d6295dd40a917f7053e41d2149f2003fee9c1adb53076d4283d66bdb066873dbb05ffc72fa6a53ffaf3274661aafd8343abe65f602c6504fdd949f50922374d04ee3e2980e846fe08a1b578ca4616659b3721685400ec4bc52fec0e166909f02e4f5e3062f6c07a97a44af88e655d1168b14c2d22ba7b3ce0a62691b73828f83795160fdb906b4062b6f63d95292a30d9467e11011f69b91255144202d58b393ed7783b6e4a39754061fc0238b7b93d229e90479242fa77b531afb1f587fbd2a2fcf3aea44bd7fafa3a598837aa80e570272dfb919244e0e032abc5b12488d6b5d95b3165d99e7a9c124b434ab3dc730cc6490f795e222ef0c6b7975b3f56b8be37da25ee94406f0359eb274620171746971ea0215766d2cf116ce09811e1350e1392654fba67c346275d39eefa2bd2352a785c44096ec190f38e4d2ccc1b357d654ba780754c"}) open(&(0x7f0000000080)='.\x00', 0x518282, 0x78e22799f4a46e8e) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) set_mempolicy(0x4005, &(0x7f0000000080)=0x4, 0x8) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000007c0), &(0x7f0000000400)=0x8) 14.752152809s ago: executing program 0 (id=3053): socket$packet(0x11, 0x2, 0x300) r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x40, 0x800000000004, @tid=r0}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r1, 0x1000) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x6, 0x40980) preadv(r2, &(0x7f0000000580)=[{&(0x7f0000000000)=""/42, 0x2a}], 0x1, 0x7, 0x800) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) r3 = syz_io_uring_setup(0x80000f00, &(0x7f0000000500)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r7 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r12 = syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x0, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r9, r10, r11, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r7, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r12, 0xffff, 0x0, 0x0}}) io_uring_enter(r8, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r9, r10) r14 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r12, 0x2) syz_ublk_setup_queues(r14, r13, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, 0x0) nanosleep(&(0x7f0000001a00)={0x5}, &(0x7f0000001a40)) r15 = getpid() syz_io_uring_submit$UBLK(r9, r10, r11, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r7, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r12, 0xffff, 0x0, 0x0, r15}}) io_uring_enter(r8, 0x1, 0x1, 0x1, 0x0, 0x0) io_uring_enter(r8, 0x0, 0x1, 0x1, 0x0, 0x0) r16 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r16, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) 14.484128587s ago: executing program 32 (id=3053): socket$packet(0x11, 0x2, 0x300) r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x40, 0x800000000004, @tid=r0}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r1, 0x1000) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x6, 0x40980) preadv(r2, &(0x7f0000000580)=[{&(0x7f0000000000)=""/42, 0x2a}], 0x1, 0x7, 0x800) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) r3 = syz_io_uring_setup(0x80000f00, &(0x7f0000000500)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r7 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r12 = syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f0000000200)={0x2e, 0x0, 0x0, r7, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) syz_io_uring_submit$UBLK(r9, r10, r11, &(0x7f0000000600)=@ublk_set_params_sqe={0x2e, 0x0, 0x0, r7, 0xc0207508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r12, 0xffff, 0x0, 0x0}}) io_uring_enter(r8, 0x1, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r9, r10) r14 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r12, 0x2) syz_ublk_setup_queues(r14, r13, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, &(0x7f0000000a00)=@buf_4k}}, 0x0) nanosleep(&(0x7f0000001a00)={0x5}, &(0x7f0000001a40)) r15 = getpid() syz_io_uring_submit$UBLK(r9, r10, r11, &(0x7f0000000c00)=@ublk_start_dev_sqe={0x2e, 0x0, 0x0, r7, 0xc0207506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {r12, 0xffff, 0x0, 0x0, r15}}) io_uring_enter(r8, 0x1, 0x1, 0x1, 0x0, 0x0) io_uring_enter(r8, 0x0, 0x1, 0x1, 0x0, 0x0) r16 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r16, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) 11.122654459s ago: executing program 1 (id=3061): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000140)={0x4, 0x100, 0x1, 0x8, 0x8, "038fcedba704469238ce9e0c2a09227527995b"}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x77d227bb, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x6}], 0x1c) socket(0x10, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c460004"], 0x78) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="00070800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c"], 0x4a) syz_usb_control_io$printer(r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="230000000400000008000000c00b000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES16=r0, @ANYBLOB="010000000300000000003a9d00"/28], 0x50) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) syz_open_dev$ndb(0x0, 0x0, 0xa844f2cfb5867eb6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x800) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @private1, 0x3}, 0x1c) 10.689816181s ago: executing program 4 (id=3062): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000340)=0x1) ioctl$TCGETA(r0, 0x89f0, &(0x7f00000029c0)) (async) add_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000200)="605a4a408f7ebd69724206304c94920669dc832a9ae14df04a8f748153fdc6f082ea8463d9185bb2a1c043c06c2bb4441317c84cdef3961d417a32fc32304fd1e60ab6e2473d9e25aac70f1d", 0x4c, 0xfffffffffffffffa) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x4, 0xbfb, 0x5}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) iopl(0x3) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async, rerun: 32) r4 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x66e8, 0x8000, 0x8, 0x6a}) (rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) socket$rxrpc(0x21, 0x2, 0x2) (async) r5 = socket$inet(0x2, 0x3, 0x4) shutdown(r5, 0x0) (async) recvmmsg(r5, &(0x7f0000001c80)=[{{&(0x7f00000003c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000440)=""/36, 0x24}, {&(0x7f0000000480)=""/101, 0x65}, {&(0x7f00000005c0)=""/94, 0x5e}, {&(0x7f0000000640)=""/162, 0xa2}, {&(0x7f0000000700)=""/223, 0xdf}, {&(0x7f0000000800)=""/230, 0xe6}, {&(0x7f0000000900)=""/128, 0x80}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0x8, &(0x7f0000001bc0)=""/169, 0xa9}, 0x2}], 0x1, 0x0, 0x0) (async) syz_emit_ethernet(0x6a, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c200000eaaaaaaaaaa0008004503005cffff0000002f907800000000e0000001248032eb000000000005000110000800000086dd88a888be0800000010fe0000200000000200000000000009000000000800655800000000"], 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) (rerun: 64) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES16=r7], 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) (async, rerun: 64) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x15c, 0x10, 0x1, 0xfffffffe, 0x100, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4e23, 0x25, 0x2, 0x0, 0x0, 0x3a}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4d4, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x36}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffb, 0x3}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0x4, 0x3ff, 0x9, 0x5}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000009c0)=ANY=[@ANYBLOB="480100001a000100feffffff00010000e0000002000000000000000000000000fc0100000000000000000000000000014e20071c4e210005020000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc02000000000000000000000000000100030000000000000f000000000000000600000000000000fffbffffffffffff1c25080000000000a637fffffffffffffcffffffffffffff0000000000000000ffffffffffffffff0000000000000000ff01000000000000fefffffffffffffffefffffffc030000000000008000000005350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008001d00fffe1e0000000000"], 0x148}}, 0x844) (async, rerun: 64) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (rerun: 64) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) fcntl$setpipe(r3, 0x407, 0x100000) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) 9.613494942s ago: executing program 4 (id=3063): ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[0x101, 0x0]}) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000080)={0x2b3, 0x80000, 0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0xc00) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, &(0x7f0000000100)={{r1}, "d817a85d9dc3569f81de8fdbf2021e8350da7752eeccfea56e9258ec6ce986bcdb6d60afdfdb51ca81b2221e4eb400a4d90b9dba194ee7e48887f04e0359fbac4e14572ac69de09215b44700ee992dff445e33fde958b9367a82bb1750097f391dc0725560ffd2a19b87d9aafa72548dd1df113da87e6763553a2096e01c2db75949cadb849c21d4281f9790eca17c216b479aa7a2f5ebc917aed89d3c71c5ae910f1109b8cd9329eccc1e2aaf65ba6ac24652ad33eb32fb2086fc68d5000ce948547005cfa9eadd339623356c9a8a381ee1dfe2168e75a94a9408146680a7db67cb48f106af9a79b749137071c56cef73347395578abc62d69c7590c763cc18802018b5cc776dbe8be99b8452495eb6402b4e493480783bf0c3e1064beeaefa77967b1ecf056db3ed90548b1e55a724e88e504087cfe27a3f48ef3058c8845f9a4611d71b164f04ced3333ed2fa2c56fe25e26b505d798d4062d9e0690db4d09aa598e3b65af99ae3ecd8f0640a553309a8bc4cca2168603ec658b1959ccb3b893497e07b82a27ccf8a245c43a8bc3576794ebd34a131cf7d151f24e2b438af72e41ae8cd9af11c7bffa8917cef45c6dc948c12dcc40aa0ce1fbedb030d0d1cefb5875bbefad3039e0d0bfb9bcb4f77ce00494a88ad947264b267dbb5f9941155c8bc658aba6052ae62339b5a18455dcd0eb5774d6f4a0d446ef44e70616bed69afa3538feab42542c75e007ea79548ffd66c8cb79412a7e84e83edf8e79d30341015c8fa64b49ca1e4c0862ae3cbb3677aec3cc1469dd1157672444a57fe3a97d55444c7233e8cd302e7bc5de63f6eff0a54deb579c3a1a941c60f24d056056da7827f2ea7fcfb6bd03dcce2879005ab11f887b0b4ff672d3bd944daebc630a069589c271cece91260e5a6669541a54726efb02e63672a03c0d827b63f540a4acea3145a15334783c4160dbe10b37d0da6e1044187d16c9e3716f89afb2862874eeaec12ae66a627a8c9b94e579adefb00f32fd9265e283ebfa3ec18c883a8c199dbcde6a981bc91fc43547c321aff58ef6f5f5a7583770087ff6f0d20c6d66ddf176d45e09837d96298a4b32acc2e34bb5dd73fc2e5d4ab3f3033008a91dd9d6fdb3c36a171463d0c83ef878320bb1114f22c566f0eff31a9f92606d1bf337faf6bf3ec5cc0541a29e6e409b747726e0b6babce838615284893af2029ffbf8f17bf205522374e8a44c5185882879730bcf0b600a6e3edbe4dd689ba9182089b2730c88c1e67ecf881c7f89a810fafbff1aadf6b09972c3202913d6feaf5dbec58fe0bc67e6736fd37feaa22e296532f2c39f471d4a274aa5da57f1b72e14e23a689975e3b21b45876277b02f02f310a439bb50e7a0ea56d80595e561993231393e16eb27ba22db3631ce795d4fefa220f56106f1879fed2b1212609b5e18de473d83df94c92fe77a8187c5f52e7a26bfaf1f43250816656983e9bb1c147bbe3bb161cd212c684e2b73acbff4f025fdde7ba64e9ca14d5f9a5e739e91c947583ce797de6b7c1bd616444543f4c2f8c413527b962376904c20f77574675a4b022115efb9583a9c8dc86481156b572fe96fca476b468c9209c0d32be00f6b2bba74685ea1bb54384d17fd3016d8544e9838863f10e29ef7d636ac5114f99bba78514367103a9956a2f19beee24ae59f4e64037b3848a1f1077c346227b79e703fab1ac689c6ecf0e44e7298807ac778c5f1c2d3a4b5ea24ff032bb0166c920d09b62dfc2d1fb6421065226bff497bfda4a034310d11aa5a5ed8b8ad227eade48c8c624b125a260fdc3e8bedf37bd33ef33c5771ac4cbb831358da1b37887b46ef155e704a299f6a90e20518cf24ca043bcd6ebef42303b044386a4529483f8c4f8b9b5a00e6a87a6d13dfa646b041ced65f32dd4f26a2ec24461d4527505239d6b58a26d9afa6e43665bb42a8213a3d96b7fe89ebd7b5854070cb9489ce792106e7138da1826af062c20fdb94120b1c4cf9a73db5a29b4742dcba6dad22cb8c499ef7b4f4dce7e0aa64a4fcfc9970b29b2f1c005f589bfbdb2c2c8df18236ee80ca5618dd5bbd8a9553cdc9fa5021118c0ea68ac0e7f5b8e5c1a71e41989b413b38fe4ba58b34b9bd0b72b55837679e0c146424bcb68289623979096aaea73ac33480e0a8e3950a3ddeb36adb4bd3d0d7502ba9585c8160a5b6868da51180b5695bd5dd655e67f11a75d08a4a3a7b9bfb28c0af67eb13e6329687fa7a6856fb4d69d459d6be45dee675f6d3927937d1bd34fc924b987695957f26403194d9200603d3027218569a56b5cde33a45ca88e975d4cd5bd1b61c4dba4f666ecc9cf8794829bbab083ff3a0c42d8b9989f4670f728d621a52dfba9ac1359e7d6d6953593491859921ce616d9721fe62702b8f9f9c1a8de86b7d2411a1da295446e472d3a11ec55889e529b43fbd41e948b2104e4b11c16f59edc74b787fbdc9558bdb95f45d5836152032d0e301bde695d73389b1781f2e34830af0696c97bee3f1dfef4f8b745f561d358afe285b44403de59ec6afb9294ad4ac767240eb2279cc137bf216a560455d65af284f06f86c9a56a72c3f7a834f8356f44635f6f6ec3785521924fdbf2e2d244b55028733f6560bab71aad17b8118a4b7af231952305db46e1f700efc719842d4216d29bc04c3cc5c6d857f4f2d9b69f330c0f56bb58ca9ae37f61ef6eb3c46fe52d30e9b28c0c8b5e8071ddeaeb8743c0b0956d3c90633f2aacc9e48c2dd3cde6a677c5ebf3c4fb28c11e0bc4c1df2b77aec494eb4a9f24529b2e43d8f4fa399cce4824a9e747b2ad23afa9d1e0f359a7fd447005279b90761c8c353ca5a50894b4413dfc471d8d53d22130ad16c731f8b40aee0b22220d281767cfc16252d7f955659212fa68d0f0b5fdadcfb41f861a78c19ed8b3ecebfe4ef7d14e6d579f0443c3b4b438b5822227cd79d65fe3337563680af83bdd59fa577d505c809306266fb9e2e6e7a4399b63dd1a441a78f5db46e6d25eb2119303c5243c5108b46737b09fe652611351489c8d85b8de24df95aaf023b3cba3d28323afacda72eb5efd3cb0b2fe74187c27ed75e0a0ad16edd864d5d66e2240e329a31dddc248daeea32ee9bc00b9ab378ff4d1826bf5862bc04baa91127ef3243859e93f902d674a8755e169f094d836829f71eb5e3ab9d6dd923435ee786fdc3448dd602cd01b009b7fb6dc104c9892b94c3e3162384e511bee9c1813927cb1d76b2cb34d932ca0a4179a31f0c41c1bced0f5ed8794a36cf59cebaa005928a3e2dc0b854c214f6281ef965629f9b7d09c1b64ed6f2ae20e27ff1f590c72f114c7f7ab2fcbda8df1639142d2676c7379707c4961988c2f999cefeaa82104e6993152a9d27c187228d861fb2ad63c0bfefdff57b9e99bcf1c8b4563c6831398d372b2f392da8f391664861976ed583616957bcbe4a50fe12fc15cac1f7676c9390e76c967c273f1cc3e00d8143cceddf7fdd7bbd6ee4c9354e1d5c30dc2dcff8d2f8fe3989cf022c84192e66ade4f43b9fd904ddc1946cc9a5697ac9dc2bb2ebcb6e38edf9f23aa9e030e7be7c1fb03cd5ca626c84cb414dcb031ecf26d738cc33f8230ca5e360535f893b3880bd78da572f676f0752cbea44e69ac867c8fe86fb7fd14cee281cd403b3ec09492480cd5c79286dc663f7bf660c55f9c7dc48a2eed2850a092143376c3693c1ca0290045e7e9285846930c85a66d804df589799b90d74c0bc3eb6428ee0282fda28ad4d64e2fff79869b9e8da099ffd3dec2280a4cf5d0a626413bd45f4ff917ff3895bafa402cc9f2bec2ae7acd9012b1cab1316d13cb27643815089f7a3f92061bb0659dec910e823b69cd1224d236c64e62e0bc22130cdea3b4ca0580bb166ed62d4729bd159b76c0d0b87331b69a368122c7dcad3d284e04a5c9d6074aaa12da3855aa2bc42f8cb5118203d9e5ea0902de2d717a83e81126a3b70b9aedecac19ab1bb710059cbfe561c681a225c606fefcc6fe5c35071ddc7646fa30d29d1b55c66b0e28e973099c58abd27073af0c0124411ea5f2b3ac823f177616a16fe91657437a2b5ab2d8e1664e655f8150af1ddad7b1139d75ec7233b09d419f701111a5486c86c5d3a0675759c5d9ad8257ca2eb7b359b44c9bd6fe1f7d37ef29cd9593c425b0e33fd1084f62d37fa80689f04c5db2a56ff8a47fb02540bca0f87e254422aeb77463b493d1b2f78a226196edb4e2b747be0d26f564412f0d4fa973d24c60df14dcfda8aebf3f1068473e2a07a99ffa1c4ff02aafd6343e8ca8a4f36d98b842a891e2372f3466268227c121dc1347cb749386a37e824f82dbed22b9e6f9dc042c507234a57b848ccfa8b0c9aca6daab9aa9a18de2aea259680d031649b8fa574c384f4eea76cddea6cd945849127c4e9d078896b33b5cb94e5735aa10cf80e7446d3f67c05ef04862090ee375d996c6abf5b9e8de175ee218e78c283dc34dcd280412a1ab16821a49c81c00fa805c458055a7556da79398856e3fca63a0f54939361b8b16cc5ee5dcd46ded57c381ed76517654047f12cb109c492f89353446dafeb58bb0045793c00a9582f7c1d5fafac2374e19bcc0b57987c5ec6bc30311b7c045a8c58304da2fe12d6b9bdd9955afbb023ee3821f8f097f4677c0c2a4df27e641afec5e5002cf9e5a6fa59e05cb0dd0f51b4d37d3e165152ddcd141b1335d8316c20c4c94745511b4701bc7b6fe17392e16e86f800548e51786f6f4cf97c0361f615d9a21d40f024385381095a794748654f3b44dd52951df6e919fbca812cc943ea8353e359f396137893d40fb6b2c7f660b786a8a364fb6278e9190a7cb48b59e49a5980008dfed8a2503c1aa032f21ee17f211b3ece6e371c7658f842ff35e44ad197a030b357a41efa4be9a3cece39dcb2e4375874cbd83449b3eac47282a57ba53e5714c604b660a61e647e350ea28bf61a19832311ba727402d5bbfcd629ea672819a62fcde901a22765dc6035c1ba7e5003cca58aec3ff5f034938ef8c0b8d46559f38100936c31e744a4f1f8ac05f129e0da2c81d7fb3c74dbc3f718589ec002f5d04c7ab1a91b4f9f8f26aaa0b264e7ca2c3fe8487bc7ba6cbda15e1ddd62880e84c870f1e2f96eeece7b161cf3892d9ad7cb4f5b11df0533e3977acb6885adad0fcea72bb81d86b313c996f13c0f8b81923c1f2473165416d4bde6024e18f043932e61862ce693c2b506cd5974decfe000e0cf537431f5a0ee2527d0c65e5d0b781803f2d8344b42c8cb88a127f0ad3c85b40df8a10708c02087b54a4fcbc77a57f9530335ddb61eaa20011086f1935fd59d9898829582f0f4bf6f1953f427beb614e3216288486aeb16722d046390a0708a1c74230106bb093e18f73e805cadd1037460686804c799bae44908ba011653b813f936cf7644f4805ab3bc5b6a55f17384a154088c1477f77bf9e45adb5a9e5c9b317de95c5b0b937136f8e2b29ac83f06a1f6455d05686dd53c45ff5b88a6892fed0e0d37616d328604e2d8994a94cd6239b5023bc600f2f92f9ee5c3b40e52ac744fd330cc8b4525c7c60556c0d2bd7310d0fe86459a67af4499461944c1e4a6c0f569e01fd6170ce32326ec00e0352912e48d9c7ef8269a670c0b2bafa0960efd1cc40edc7f820f63347be3f7202bc7869c8506bf82e87e15f1c6646adf535bdbfc5ed832c32589f5bad071a3ddd4664ae8ceb02323e6de4098750f567d244c0fa7bb708b5a210abd0eac03d"}) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000001100), 0x101002, 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f00000011c0)={0x8, 0x0, &(0x7f0000001180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000001200)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000012c0)={r3, 0x0, r4, 0x0, 0x0, 0x2, &(0x7f0000001280)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000001300)={0x6, 0x2, 0x5}) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000001340)) fsetxattr$security_ima(r2, &(0x7f0000001380), &(0x7f00000013c0)=@md5={0x1, "325e5d83cbdcf82f0cb05eee88b5b33f"}, 0x11, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000014c0)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000001400)="c2ef20a079930e978c280119d49907efec47ac072849d27da7cee6f9e585bc7a4aee580876e81271443e2fe4946d2d222bdabd8998571c0df32774f1b323f11a7c1718d1f9e75a01186702afcf94b4ce7518196e6b384f0f12a324628b3f91c86cac1752b026c44908f6db1d95e837b25c9f1ccf4fb96d078adda505856d44883bbf1f6c782a4b383beacce23bb88aa375821c1bcf71da0636ba53a566cbe099af75052cae70bc7e965f24e4", 0xac}, 0x68) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000001540)={&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x3000, 0x1}) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000001580)={0x0, 0xb0c}, &(0x7f00000015c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000001600)={r5, 0x9, 0x20}, &(0x7f0000001640)=0xc) futex$unlock_pi_list64(&(0x7f0000001680)=0x5, 0x207, 0x401, &(0x7f00000016c0), &(0x7f0000001700)=0x2, 0x200) execveat(r0, &(0x7f0000001740)='./file0\x00', &(0x7f0000001940)={[&(0x7f0000001780)='/dev/cec#\x00', &(0x7f00000017c0)='{\\-\\,\xc6\x00', &(0x7f0000001800)='security.ima\x00', &(0x7f0000001840)='\x00', &(0x7f0000001880)='security.ima\x00', &(0x7f00000018c0)='\x00', &(0x7f0000001900)=':*\'\x00']}, &(0x7f0000001b00)={[&(0x7f0000001980)='/dev/cec#\x00', &(0x7f00000019c0)='/dev/dma_heap/system\x00', &(0x7f0000001a00)='&\x00', &(0x7f0000001a40)='/dev/dma_heap/system\x00', &(0x7f0000001a80)='/dev/dma_heap/system\x00', &(0x7f0000001ac0)='/dev/dri/renderD128\x00']}, 0x100) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000001b40)={r6, 0x0, 0x7ff}, &(0x7f0000001b80)=0x8) linkat(r0, &(0x7f0000001bc0)='./file0\x00', r0, &(0x7f0000001c00)='./file0\x00', 0x400) ioctl$OCFS2_IOC_UNRESVSP(r1, 0x40305829, &(0x7f0000001c40)={0x0, 0x1, 0x7, 0xfffffffffffffffc, 0x2, 0x7}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001c80), 0x400301, 0x0) io_uring_enter(0xffffffffffffffff, 0x6b2, 0x36f4, 0x28, &(0x7f0000001cc0)={[0xe]}, 0x8) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001d40), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000001e00)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d80)={0x30, r7, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x81}, 0x40001) socket$rds(0x15, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001e80)=@security={'security\x00', 0xe, 0x4, 0x3f8, 0xffffffff, 0x200, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x328, 0x328, 0x328, 0xffffffff, 0x4, &(0x7f0000001e40), {[{{@uncond, 0x0, 0xd0, 0x130, 0x0, {}, [@common=@inet=@length={{0x28}, {0xff01, 0x8, 0x1}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0xff000000, 0x0, 0xff], 0x4e21, 0x4e24, 0x4e21, 0x4e21, 0x80000000, 0x9, 0x428a, 0x1, 0x324}}}, {{@ipv6={@private1, @remote, [0xff, 0xff000000, 0x0, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffff00, 0xffffff00], 'team0\x00', 'veth1_to_bridge\x00', {}, {}, 0x6, 0x3, 0xd0de8d64139a96f8, 0x20}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x1, 0x7ab}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30}, {[0x3, 0x1], 0x0, 0x20, 0x1}}, @common=@icmp6={{0x28}, {0x4, "1fdb", 0x1}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0xffffffff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000002300)={{0x7, 0x4, 0x6, 0x81, '\x00', 0x5}, 0x1, [0x2, 0x100, 0x2, 0x7, 0x1, 0x2, 0x9, 0x3ff, 0x1ff, 0x0, 0x80000001, 0x2, 0x2, 0xe, 0x3, 0x7, 0xe3d3, 0x6, 0xffffffff, 0x2, 0x0, 0xe45d, 0x80000001, 0x6, 0xe, 0x2, 0x1000, 0x4, 0xff, 0x8, 0x13, 0x80000000, 0x3, 0x5, 0x5, 0x657, 0x8, 0xe9, 0xc65, 0x1, 0x5, 0xfffffffffffffff8, 0xa, 0x80, 0x7fffffff, 0xbe97, 0x57, 0x400, 0xb4df, 0x4, 0x3, 0x6, 0x8, 0x5, 0xfffffffff738aca0, 0x3, 0x8, 0x808d, 0x6, 0x3ff, 0x9, 0xe000000000000000, 0x9, 0x8000000000000001, 0x1000, 0x1, 0x7, 0x6, 0x10001, 0xdc9, 0x6, 0x368, 0x9, 0x3, 0x59c, 0xa51, 0xfff, 0x1, 0x1, 0xf84f, 0x3, 0x5, 0x7, 0x662, 0x4065a474, 0x3, 0x8000, 0x7fffffff, 0x6, 0x8001, 0x0, 0x7, 0x4, 0x9, 0x63b, 0x3, 0x7fffffffffffffff, 0x6, 0xe05, 0x6d1, 0x4, 0x7, 0x9, 0xa, 0x7, 0xfff, 0x7d48, 0x0, 0xfff, 0x3, 0x7fffffff, 0xf, 0x2, 0x5, 0x101, 0x8, 0x800, 0x3, 0x3, 0xf, 0x6, 0x5, 0x315d, 0xffffffff, 0x6, 0x6, 0x46d, 0xffffffffffffffff]}) 9.265916281s ago: executing program 3 (id=3064): writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)="8724", 0x2}], 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x24, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r2) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 9.057216748s ago: executing program 4 (id=3065): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0xb, 0x7fff0000}]}) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x200000b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff028}, {0x6, 0x0, 0x0, 0x3}]}, 0x10) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040)={0x1, [0x3]}, 0x6) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000280)=""/115) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r0, 0x40106e8c, &(0x7f0000000000)=[0x9, 0x3]) 8.887011688s ago: executing program 1 (id=3066): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpgrp(0x0) prlimit64(r0, 0xe, &(0x7f0000000380)={0x8, 0x100008c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000007c0)={'macvlan1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000400)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x2000008, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000800)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000900)={'tunl0\x00', &(0x7f0000000880)={'ip_vti0\x00', 0x0, 0x700, 0x10, 0x8, 0x3, {{0x15, 0x4, 0x1, 0x14, 0x54, 0x68, 0x0, 0x8, 0x29, 0x0, @remote, @multicast1, {[@timestamp_prespec={0x44, 0x24, 0x88, 0x3, 0x8, [{@loopback, 0x30000000}, {@multicast2, 0x5}, {@rand_addr=0x64010100, 0x7cd9}, {@local, 0x24b}]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0x43, 0x0, 0x0, [0x6]}, @generic={0x7, 0xe, "abb73471590e5a4140817210"}, @end]}}}}}) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000c40)={&(0x7f0000001300)={0x310, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_WANTED={0xcc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0xc8, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'batadv0\x00'}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xbf8}, @ETHTOOL_A_BITSET_BIT_NAME={0x14, 0x2, '/dev/sequencer2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '(,\'.\x00'}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '&*\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1a23}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x28000}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}]}]}]}, @ETHTOOL_A_FEATURES_WANTED={0xa8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x9b, 0x5, "0ec902769de0b4585f562e781266e35f3c22d99bbdf42254af64eea29353e088c37a3a95c97819ba681ac400d9448fb4a938ed1c2c36c6146a86817186bcb09784c97e20e18d29b505c892d1f1c19282cc37f079b4da4e5cce2dfcf5ff71562b14e87b528ac6cb1ec15c8905e24a505dc6389186ba3eeaa5fa9807cfca57427b4da7936bac8a965bf1bd4224b7d4118c3d0928d4e5e30a"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}]}, @ETHTOOL_A_FEATURES_HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1ff}]}, @ETHTOOL_A_FEATURES_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x310}, 0x1, 0x0, 0x0, 0x2400c044}, 0x0) setsockopt$MRT_ADD_MFC(r3, 0x0, 0xcc, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x24, r9, 0x331, 0x1ffc, 0x40000000, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) 8.81104497s ago: executing program 4 (id=3067): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) recvmmsg(r0, &(0x7f0000004780)=[{{0x0, 0x0, &(0x7f00000019c0), 0x0, &(0x7f0000001a40)=""/96, 0x60}, 0x1}, {{&(0x7f0000001ac0)=@caif=@dbg, 0x80, &(0x7f0000001bc0)=[{&(0x7f0000001b40)=""/105, 0x69}], 0x1}, 0x2e4c}, {{&(0x7f0000001c00)=@ax25={{0x3, @rose}, [@rose, @null, @default, @remote, @remote, @bcast, @null, @default]}, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000001c80)=""/64, 0x40}], 0x1, &(0x7f0000001d00)=""/253, 0xfd}, 0x2}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001e00)=""/4096, 0x1000}, {&(0x7f0000002e00)=""/226, 0xe2}], 0x2, &(0x7f0000002f40)=""/216, 0xd8}, 0x1}, {{&(0x7f0000003040)=@nfc_llcp, 0x80, &(0x7f0000003200)=[{&(0x7f00000030c0)=""/78, 0x4e}, {0x0}], 0x2, &(0x7f0000003240)=""/4096, 0x1000}}, {{&(0x7f0000004240)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000004600)=[{&(0x7f00000042c0)=""/199, 0xc7}, {0x0}, {&(0x7f0000004400)=""/83, 0x53}, {&(0x7f0000004480)=""/117, 0x75}, {&(0x7f0000004500)=""/74, 0x4a}, {&(0x7f0000004580)=""/92, 0x5c}], 0x6, &(0x7f00000003c0)=""/230, 0xe6}, 0xa}], 0x6, 0x40000020, 0x0) mount(0x0, 0x0, &(0x7f0000000340)='sysfs\x00', 0x298c010, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) preadv(r1, &(0x7f0000000700)=[{&(0x7f0000000080)=""/111, 0x6f}], 0x1, 0x7, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e22, @multicast1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x3a8bc000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x16f) write(0xffffffffffffffff, &(0x7f0000000300)='usb3503 0x0', 0xb) 6.301005249s ago: executing program 1 (id=3068): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_open_dev$sg(0x0, 0x0, 0x8002) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) read$FUSE(r3, &(0x7f0000002a40)={0x2020}, 0x2020) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @time={0x0, 0x5}, {0xfe}, {}, @quote={{0x7}, 0x2e}}], 0x1c) sendmsg$IPSET_CMD_PROTOCOL(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004890) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x200000) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x80c, 0x30, 0x100, 0x2, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}, {0x7a4, 0x1, [@m_connmark={0x120, 0x9, 0x0, 0x0, {{0xd}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8, 0x5, 0x8, 0x4}, 0x200}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x4, 0x10000006, 0x9, 0xfffffe01}, 0x6}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x8, 0x0, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3495, 0x80000001, 0xffffffffffffffff, 0x1ff, 0xffffffff}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x10000, 0x5, 0x10, 0x5}, 0xf887}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffc, 0x1ff, 0x2, 0x4, 0x2}, 0x1000}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xe4fb, 0x7, 0x3, 0x8}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1256, 0xfffffff7, 0x4, 0xfffffff8, 0xe9d}, 0x2}}]}, {0xd, 0x6, "a947ca9a2469af8338"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_sample={0xa8, 0xe, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x6c}]}, {0x6a, 0x6, "8c716ded4d3c5cb1016fbe7f01dae2b4327059ed7de022fcacf2a63c9017a4239c04021b5b3df241a4f8bd414fa6c37ff184a4fd4f6be3d7b48fca173d3fb6859b4718f85dc1ba1ba63a113f4be091e2a285b761da4a43c7b65e04b4d49cf7492a503860942d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_police={0x4e8, 0xf, 0x0, 0x0, {{0xb}, {0x41c, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xa, 0x1, 0x7, 0x6, 0x2, 0x40, 0xc0000000, 0x8000, 0x4, 0xffff, 0x7f643e6, 0xe, 0x2, 0x6, 0x10, 0x5, 0x80000001, 0x4, 0x2, 0x81, 0x8001, 0x9, 0x4, 0x7, 0x3, 0x8, 0x1, 0x400, 0x14000000, 0x5, 0x8, 0x0, 0x3ff, 0x7ff, 0x6, 0x4, 0x469, 0x7f, 0x0, 0x6, 0x5, 0xca6, 0x100, 0x10001, 0x3, 0x80000001, 0x5e6a, 0x7fffffff, 0xcc2, 0xacb, 0x9, 0x2925, 0x6, 0x4d, 0x6, 0x80, 0x1, 0x81, 0x2e6, 0x1c00000, 0x0, 0x7, 0x5, 0x1, 0x1, 0x3, 0xaea, 0x6, 0x5, 0x3, 0x2000, 0x6, 0xaf69, 0xabab, 0x1, 0x5, 0x2, 0x3170, 0x2, 0xb, 0xffffffff, 0x1, 0x1, 0x10000, 0x5, 0x9, 0x6, 0x3ad7, 0x7, 0x0, 0x4, 0x7, 0x3, 0x800, 0x81, 0x340000, 0x8, 0xfffffc01, 0x200, 0x1, 0x6, 0x9, 0x6, 0x80, 0xe5b, 0x9, 0x1, 0x7fffffff, 0x7fffffff, 0x2, 0xffff, 0x3, 0x356f, 0x5907, 0x4, 0x93, 0x6, 0xa41, 0x3ff, 0x2, 0x4, 0x2e55383e, 0x147a, 0x4, 0x10000, 0x36, 0xfffffffa, 0x5, 0x7f, 0x6da, 0x100, 0x80000000, 0x76, 0x12000, 0xffff, 0x6, 0xba, 0xfffff46a, 0xb, 0x6, 0x0, 0x4, 0x2, 0x4, 0x101, 0x3, 0x81, 0xe, 0xb3, 0x10001, 0xf47, 0x1, 0x8, 0x400, 0x1ff, 0x8, 0x9, 0x3af, 0x10000, 0x1, 0x2de, 0x1, 0x2, 0x0, 0x1, 0x1, 0x4e6f, 0x76, 0x2, 0xb, 0x5, 0x9, 0x1, 0xfffffffd, 0x204, 0x7a, 0x8000, 0x80, 0x5, 0x0, 0xc, 0x1000, 0x9, 0x9, 0x7, 0x7, 0x3, 0xd, 0x0, 0xfffffffb, 0x2, 0x9e4b, 0x401, 0x3ff, 0x7ff, 0x80000000, 0x7, 0x8000, 0x8, 0x40000000, 0xfff, 0x4, 0xdb, 0x7, 0x4, 0x3c84, 0xa58e, 0x5, 0xbd, 0x4f7a, 0x3, 0xdf31, 0xa, 0x1, 0x101, 0x10, 0x0, 0x3, 0x80000000, 0xf, 0x401, 0x8, 0x24e, 0x81, 0xe17, 0x3, 0x6, 0x35, 0x6, 0x2, 0x7f, 0x4, 0xc, 0x7, 0x2, 0x45, 0x6, 0x100, 0xfffffff8, 0x100, 0x9, 0x9, 0x55f4, 0x10000, 0x5c2aaff3, 0x5, 0xfb, 0x5, 0x7fffffff, 0x6, 0x0, 0x0, 0x729, 0x6, 0xa]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x6}]]}, {0xa3, 0x6, "68e47b32cb1f942dec9111ae5f6f0b5c506919f67687dc11ca20a4932e861970bd558aaaf0efd12d3dbf1367bc92538a8fc6a63134bc0e4cf33f3a965b3940a7bfb0ccbfce36b68631b20a4b753cf47a9898e2e2eb3c3366e2eb195e7e30f35b83df5083e4524866fdef786a87d23bc875ac2d70351a23029e04380f7137e2b49a3b4fb13f3514ececa71830643cf01cdd2cd1775f4c95bf2448b764cf6a84"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xf0, 0x1, 0x0, 0x0, {{0xb}, {0xa4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0xa, 0x3, 0x4, 0x5}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x6, 0x4, 0x0, 0xf}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x6a6a, 0x1f, 0x3, 0x0, 0xfffffff9}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x4b1, 0x0, 0xb, 0x7f, 0x25}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x162, 0x400, 0x0, 0x1, 0xcdc}, 0x1}}]}, {0x24, 0x6, "464f463735fa6656ed6ed25ad0dfa3a4adf48bcba2e868c65d4b3823f12b591c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x80c}}, 0x8000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x5, 0x3800001, 0x401d031, r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000500)="8100dca40704185995cf3ab2f97104ae0480e08ba3fe77bed703ed94bfffa7be5a751dabd5b5d7216ad9d9a57466738e725be872a715547ce60cc623b31aaa8f7e05f88d47bca1273a8db8831af246a7879400ba923e3c80d84ef1fda2357da101585de6727af2a56bf5eb040e40103e513483f8c8be86c0f4f9b218508ee0ccdd857643d0985da78590cf3f885368f4573b893bcc97b9cbfb781aa9e68b2ec3187163db24a64c122bd6238f5a930fef4979ad89f9deac6ae658b56432e0fef545e7d4cd4c1ce6ae4c475a0366a962a74e4d142aef89a308613d58abab", 0xf000}, {0x0, 0x2d}], 0x2) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, 0x0, 0x0) connect$inet(r5, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r6, 0x6f2d, 0x400000002000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000ac0000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000094200009801c0002800c00018008000140000000040c0001800800014000000004440000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) 4.877249427s ago: executing program 1 (id=3069): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000), 0x8) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 4.833655964s ago: executing program 3 (id=3070): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000000), 0x5, 0x20001) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r1, 0xf504, 0x0) setsockopt$sock_int(r6, 0x1, 0x3e, &(0x7f00000000c0)=0x20007, 0x4) bind$llc(r6, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) sendmsg$nl_generic(r1, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, 0x18, 0x400, 0x70bd2c, 0x25dfdbff, {0x20}, [@nested={0x83, 0x94, 0x0, 0x1, [@typed={0x14, 0xd7, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @typed={0x4, 0x76}, @generic="2eae364055499bfabd435fe11d5e1074f9e6ee99b2eca486ac0a06cff3e76eddef1a2cc5b2f75522967903e99a065cbcb08359278cf8dcbc1c0dd04321ea0b8c101e0a61aac6c2cb701918c0f5f59b74515cec94ff2f8492d4df74897d2e48de317adc453029b8"]}, @generic="617f4b6701077577ddf79b4337b360aad89f05525e6bce9f6fce1a23603afb01d9552adb001237c84d8cf438dab76fa3e520b4750aa3beae825ba28785dd1b9548"]}, 0xdc}, 0x1, 0x0, 0x0, 0x8090}, 0x40000c4) r7 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r7}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x3c, r3, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x1}, @NL80211_ATTR_TXQ_QUANTUM={0x8, 0x10c, 0x3ad76f4e}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x8c}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0xfffffff9}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x836}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4020800}, 0xc044) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e01, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4815}, 0x4000000) r9 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r9, &(0x7f0000000c80)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000100)=0xffffffff, 0x4) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e22, @multicast1}}}, 0x84) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000040)=""/7, 0x7, 0xc9108062, 0x0, 0x0) 4.38358935s ago: executing program 3 (id=3071): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010340)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000640)={{{@in=@private, @in=@private}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000740)=0xe8) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffff8, 0x1000, 0x0, 0x146, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r8, '\x00', {0x3, 0x5, 0x0, 0x0}}, 0x0) 4.375537697s ago: executing program 1 (id=3072): bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0f000000040000000400000000010000000000005c63f225d9b7536f3e5f97349bf3f11ba313538598a84d63bb456904392b9b77504280e5d58667456b18a1dad449e5c2dca6db703a1cdc08287bb8a93bec9ce8b6a2344315d039f2be2752925fae01bedbcbe04859ba10dbc80d4aa4f992cbb8d78ac34cc30e8532fbb8bac26b7fd3ec79b2ae974963e21211ef0f8939256fc151c494941b8fdfaaf79b47530077ce9cbf9b76407575092f8600e01d71abe944a2047794dc9df748076fb674c76bdec21828452e4ec2cc8036009fd2ed06c8dccb083249c7e3bf01000000000000000d70c568790f16d588ad1fbf10ca31d7436a2fe39aabfb694e20f273fffb2bc8d27fd14155abb5821148d8571a65899dfe0ae9723f02a02a42895b95393f6adead23351ac7f51e1341fa161a1ac9a91207358c56fcce4b371a4d6ac261c5ed862e1987a15758ecbe6a955a2f2c5adcf9c8e2a47c489610512be3ca913d03face73b86897bc48769d90dcefdf871369c5c61dc5b5a76ce80e2fb2ce7ae18a66ede83d81db4b6cf7f641055f2b2c4f408eadf57730ffc2faaaa96b17fc21295a3bf781aa62070d9e1a7067312c550c7af7b3ec971302eb00eb7c25fa71ad", @ANYRESDEC=0x0, @ANYBLOB="09e200000000000000000000000000000000e200", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?'], 0x48) close(0x3) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) syz_emit_vhci(0x0, 0x14) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x68, 0x14, 0xf0b, 0x3, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xffe0, 0xe}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x4, 0x400a, 0x2, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x4, 0xc, 0x1, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) socket$kcm(0xa, 0x2, 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000280)=']', 0x1}], 0x1}, 0x20004040) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000040)={r4, r3}) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000000c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="ad5a97"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="200103"], 0x0}) 3.053733311s ago: executing program 3 (id=3073): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201000000000040d90455a000000000000109022400010000100009040000c403000200092100105c0122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x7, {[@global=@item_012={0x1, 0x1, 0x3, "1b"}, @main=@item_4={0x3, 0x0, 0xa, "e811e23b"}]}}, 0x0}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r1, 0x0, 0xee01) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) capset(&(0x7f0000000380)={0x19980330}, &(0x7f0000000100)={0x0, 0x0, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14e174135c0b86de) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="89f7459a3519f2c4d69e1ee84e9d5187f68284976648dd98057653dcf40c", @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800c0001006d6163766c616e003c00028008000100100000001c0005800a000400aaaaaaaaaabb000002000400d8928afb7028000008000300030000000a000400aaaaaaaaaabb000008000500", @ANYRES32=r2], 0x74}, 0x1, 0x0, 0x0, 0xc00}, 0x2044890) 2.350033133s ago: executing program 4 (id=3074): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) pipe(0x0) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000880)=[{&(0x7f0000000180)="4d34feb4e7f8e50000075483024b58", 0xf}, {&(0x7f0000000440)="56106c6a7c8b4b6c95914975c76c6290f78b98839fd84205f7b831f7afdec136aec1", 0x22}, {&(0x7f0000000500)}, {&(0x7f0000000580)="388cafcfd35543770e91a7c2f69580dee5198f352e107aa77543", 0x1a}, {&(0x7f00000005c0)="92010d2038836889e2f2749afbafef42e8d1fc3ae824e6b926690348611e9d5e2fb27f8000f76f2eb4ee6346997aa819c4cb739e29b2638ec9777758d844a95354e9ec72da1b6cceb9d7fad27e31e75d2197330ed45c74b5b19d355e91194a82316173a702e8484822badad8d721d7ab60ff0bdc96f5cf4a87ddf5a0154e894c23ee4fc1e42ed2148a1117f9ccb4ff8ea14e0040e824055c883799264be1e2f65631dbcbf5ad59f5f2fbbc6a5a5032c77c55162ab7fd676a5d9badb343e43867792f891bdf764516", 0xc8}, {&(0x7f00000006c0)="f2db10b5c4b6f9239c64948b149c486615911d46bb6445de767a16620dae9099115d562c1c2be25113d82f6fad5f6762e78e5ccbc7ab46e55f5385f9f447b0ddfbf9787b402d006e99c317ab9c67e4cabe9b5e524bd382988e22a22a5972f0432ad15511dcc8d1f4d7a0232d907b185a0f88728651f6283f93734337310a3223b1f4aeaddceceb36142ac7c901dd11c489936419b4a27e49a7b7e49a36d155fad111b2e93d970fc74c6cdf3efa4cf00556f18b4555fd2caf05898c4ef287851d07fa39cdc3757cf069398393876274c2ee26e3418a777e7e39953ddebd505a7c9dea0242df3757e6449d", 0xea}, {&(0x7f00000007c0)="5c621ad687e0f8d9bc2161e82b2535abe951f58cbe52eee17db06385c172b9eb3fbfaed988f3904a7dd5b22dd2ed32de8911fc3ed5c20cd6ea2b964d1cb04eceb5a673d97467ea90710366f3d99d444cb6a71a59973857bb28fa99549e3fae4efa042f6a693232896aa43640a7c422e646ec3da0de448c214d42b55a8ee09ef71f00c253e56938d275", 0x89}], 0x7) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='1\n', 0x2) close(r2) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='1', 0xfffffffffffffe81) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 1.190228324s ago: executing program 1 (id=3075): r0 = socket$kcm(0x10, 0x2, 0x0) syz_usb_connect(0x3, 0x3b9, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000041914140f30c75932efd010203010902a70301ab00000209046d000c27dae20009050402ff"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101901, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) r5 = ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r4, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r5}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) capset(&(0x7f00000000c0)={0x20071026}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xf17}) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f00000000c0)={0x81, 0x0, 0x3}) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f00000005c0)={0x1, 0x0, [{0x0, 0x2, 0x0, 0x0, @msi={0x9, 0xfffeffff, 0x2, 0x2}}]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000140)={0x18, r8, 0x1, 0x70bd29, 0x25dfdc00, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x400}, 0x4000800) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x11, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1836222ea29d454f6710bc5ec968b09fe97b2ac3ed92c2b6c5d86b5aada16d169b000000352e42bac9824cec1098f2feb9fdcd4ab52ec9d34c612bd4cc5375bfea26a602c917a933adca37d2781c69401dc6bfd72d46ed75f4c1069521299a9a006a72da4038b614478d7686c28b62e9702e72f6413d439c10646fe2b2c619fb433361aa3eae1fcb1a0b0bd5e32aa944"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x3) r11 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r12 = syz_open_dev$vcsu(&(0x7f0000000200), 0x5cbb, 0x22000) mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, r11, 0x5, 0x10010, r12, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r9, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffce0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYRESDEC=r10, @ANYRES32=r9, @ANYRESOCT=r0, @ANYRES8=r0, @ANYRES16=r7, @ANYRESHEX=r7, @ANYRESOCT=r7, @ANYBLOB="57a2946d3e9ba2b6da85376be4ed16dcbfa87937f65964e5bc566c901e998335167945f18128cecadba82ee433ca201c34150e25292ec4b9ac63cf12c84103c352928e530f822c9916373c25e41451791d686a1efe581be67a75b6bd8eec4f392018dd456cf0ff1c829fc1396bec6a219f7ec32e7b5809035a7ae9b9617ffb8f202d3ec4a49b40414fcd8e1fe145752113b509dbb77a60552ca43ffc604680cf6e41857e22ce967dd52ea4b1bd9b7aed3914517779edee4ff4caf2822dbcd984e3774d2745532b3ffb91700df091f2c0e0ba0ab800fd037ec6f2f60649a5f2b5509b8c95d13544c9bf31701947fb5e6315e1927906265979b0733d8e86ca88db13417cf2af1b59ca73d174"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 567.185247ms ago: executing program 3 (id=3076): syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) bind$inet6(0xffffffffffffffff, &(0x7f0000019340)={0xa, 0xe24, 0x7, @mcast2, 0x2}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102400, 0x19000) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="1811", @ANYRES32=r1, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r2, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(0x0) fanotify_init(0x200, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbf7, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x16, 0x17}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x50}}, 0x8048802) 53.822525ms ago: executing program 3 (id=3077): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_open_dev$sg(0x0, 0x0, 0x8002) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) read$FUSE(r3, &(0x7f0000002a40)={0x2020}, 0x2020) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @time={0x0, 0x5}, {0xfe}, {}, @quote={{0x7}, 0x2e}}], 0x1c) sendmsg$IPSET_CMD_PROTOCOL(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004890) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x200000) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)=@newtaction={0x80c, 0x30, 0x100, 0x2, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}, {0x7a4, 0x1, [@m_connmark={0x120, 0x9, 0x0, 0x0, {{0xd}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x8, 0x5, 0x8, 0x4}, 0x200}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x4, 0x10000006, 0x9, 0xfffffe01}, 0x6}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x8, 0x0, 0x7}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3495, 0x80000001, 0xffffffffffffffff, 0x1ff, 0xffffffff}, 0x1}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x10000, 0x5, 0x10, 0x5}, 0xf887}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffffc, 0x1ff, 0x2, 0x4, 0x2}, 0x1000}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xe4fb, 0x7, 0x3, 0x8}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1256, 0xfffffff7, 0x4, 0xfffffff8, 0xe9d}, 0x2}}]}, {0xd, 0x6, "a947ca9a2469af8338"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_sample={0xa8, 0xe, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x6c}]}, {0x6a, 0x6, "8c716ded4d3c5cb1016fbe7f01dae2b4327059ed7de022fcacf2a63c9017a4239c04021b5b3df241a4f8bd414fa6c37ff184a4fd4f6be3d7b48fca173d3fb6859b4718f85dc1ba1ba63a113f4be091e2a285b761da4a43c7b65e04b4d49cf7492a503860942d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_police={0x4e8, 0xf, 0x0, 0x0, {{0xb}, {0x41c, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0xa, 0x1, 0x7, 0x6, 0x2, 0x40, 0xc0000000, 0x8000, 0x4, 0xffff, 0x7f643e6, 0xe, 0x2, 0x6, 0x10, 0x5, 0x80000001, 0x4, 0x2, 0x81, 0x8001, 0x9, 0x4, 0x7, 0x3, 0x8, 0x1, 0x400, 0x14000000, 0x5, 0x8, 0x0, 0x3ff, 0x7ff, 0x6, 0x4, 0x469, 0x7f, 0x0, 0x6, 0x5, 0xca6, 0x100, 0x10001, 0x3, 0x80000001, 0x5e6a, 0x7fffffff, 0xcc2, 0xacb, 0x9, 0x2925, 0x6, 0x4d, 0x6, 0x80, 0x1, 0x81, 0x2e6, 0x1c00000, 0x0, 0x7, 0x5, 0x1, 0x1, 0x3, 0xaea, 0x6, 0x5, 0x3, 0x2000, 0x6, 0xaf69, 0xabab, 0x1, 0x5, 0x2, 0x3170, 0x2, 0xb, 0xffffffff, 0x1, 0x1, 0x10000, 0x5, 0x9, 0x6, 0x3ad7, 0x7, 0x0, 0x4, 0x7, 0x3, 0x800, 0x81, 0x340000, 0x8, 0xfffffc01, 0x200, 0x1, 0x6, 0x9, 0x6, 0x80, 0xe5b, 0x9, 0x1, 0x7fffffff, 0x7fffffff, 0x2, 0xffff, 0x3, 0x356f, 0x5907, 0x4, 0x93, 0x6, 0xa41, 0x3ff, 0x2, 0x4, 0x2e55383e, 0x147a, 0x4, 0x10000, 0x36, 0xfffffffa, 0x5, 0x7f, 0x6da, 0x100, 0x80000000, 0x76, 0x12000, 0xffff, 0x6, 0xba, 0xfffff46a, 0xb, 0x6, 0x0, 0x4, 0x2, 0x4, 0x101, 0x3, 0x81, 0xe, 0xb3, 0x10001, 0xf47, 0x1, 0x8, 0x400, 0x1ff, 0x8, 0x9, 0x3af, 0x10000, 0x1, 0x2de, 0x1, 0x2, 0x0, 0x1, 0x1, 0x4e6f, 0x76, 0x2, 0xb, 0x5, 0x9, 0x1, 0xfffffffd, 0x204, 0x7a, 0x8000, 0x80, 0x5, 0x0, 0xc, 0x1000, 0x9, 0x9, 0x7, 0x7, 0x3, 0xd, 0x0, 0xfffffffb, 0x2, 0x9e4b, 0x401, 0x3ff, 0x7ff, 0x80000000, 0x7, 0x8000, 0x8, 0x40000000, 0xfff, 0x4, 0xdb, 0x7, 0x4, 0x3c84, 0xa58e, 0x5, 0xbd, 0x4f7a, 0x3, 0xdf31, 0xa, 0x1, 0x101, 0x10, 0x0, 0x3, 0x80000000, 0xf, 0x401, 0x8, 0x24e, 0x81, 0xe17, 0x3, 0x6, 0x35, 0x6, 0x2, 0x7f, 0x4, 0xc, 0x7, 0x2, 0x45, 0x6, 0x100, 0xfffffff8, 0x100, 0x9, 0x9, 0x55f4, 0x10000, 0x5c2aaff3, 0x5, 0xfb, 0x5, 0x7fffffff, 0x6, 0x0, 0x0, 0x729, 0x6, 0xa]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x6}]]}, {0xa3, 0x6, "68e47b32cb1f942dec9111ae5f6f0b5c506919f67687dc11ca20a4932e861970bd558aaaf0efd12d3dbf1367bc92538a8fc6a63134bc0e4cf33f3a965b3940a7bfb0ccbfce36b68631b20a4b753cf47a9898e2e2eb3c3366e2eb195e7e30f35b83df5083e4524866fdef786a87d23bc875ac2d70351a23029e04380f7137e2b49a3b4fb13f3514ececa71830643cf01cdd2cd1775f4c95bf2448b764cf6a84"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xf0, 0x1, 0x0, 0x0, {{0xb}, {0xa4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0xa, 0x3, 0x4, 0x5}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x6, 0x4, 0x0, 0xf}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x6a6a, 0x1f, 0x3, 0x0, 0xfffffff9}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x4b1, 0x0, 0xb, 0x7f, 0x25}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x162, 0x400, 0x0, 0x1, 0xcdc}, 0x1}}]}, {0x24, 0x6, "464f463735fa6656ed6ed25ad0dfa3a4adf48bcba2e868c65d4b3823f12b591c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x80c}}, 0x8000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x5, 0x3800001, 0x401d031, r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000500)="8100dca40704185995cf3ab2f97104ae0480e08ba3fe77bed703ed94bfffa7be5a751dabd5b5d7216ad9d9a57466738e725be872a715547ce60cc623b31aaa8f7e05f88d47bca1273a8db8831af246a7879400ba923e3c80d84ef1fda2357da101585de6727af2a56bf5eb040e40103e513483f8c8be86c0f4f9b218508ee0ccdd857643d0985da78590cf3f885368f4573b893bcc97b9cbfb781aa9e68b2ec3187163db24a64c122bd6238f5a930fef4979ad89f9deac6ae658b56432e0fef545e7d4cd4c1ce6ae4c475a0366a962a74e4d142aef89a308613d58abab", 0xf000}, {0x0, 0x2d}], 0x2) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, 0x0, 0x0) connect$inet(r5, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r6, 0x6f2d, 0x400000002000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000ac0000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000094200009801c0002800c00018008000140000000040c0001800800014000000004440000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) 0s ago: executing program 4 (id=3078): syz_open_dev$vim2m(0x0, 0x401, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000000)={0x1d, r2, 0x3}, 0x18) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl(r4, 0x4038ae7a, &(0x7f0000000200)=' \x00\x00\x00\x00\x00\x00@') ioctl(r5, 0x4048aecb, &(0x7f0000000400)) ioctl$KVM_RUN(r5, 0xae80, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000040)=""/4, &(0x7f0000000080)=0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/fcloop/ctl/add_target_port\x00', 0x82001, 0x0) write(r8, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x74, r7, {0x0, 0xa}, {0xfff1, 0x9}, {0x9, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x46}, 0x20004844) kernel console output (not intermixed with test programs): pages:0kB present:3129332kB managed:2530536kB mlocked:0kB bounce:0kB free_pcp:51704kB local_pcp:17472kB free_cma:0kB [ 1146.369114][T16149] lowmem_reserve[]: 0 0 0 0 0 [ 1146.369186][T16149] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1146.369413][T16149] lowmem_reserve[]: 0 0 0 0 0 [ 1146.369587][T16149] Node 1 Normal free:3950448kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1146.369760][T16149] lowmem_reserve[]: 0 0 0 0 0 [ 1146.369903][T16149] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1146.370587][T16149] Node 0 DMA32: 625*4kB (ME) 620*8kB (UME) 221*16kB (M) 193*32kB (UM) 71*64kB (UME) 35*128kB (UME) 28*256kB (UME) 29*512kB (UME) 17*1024kB (UM) 5*2048kB (UE) 290*4096kB (UM) = 1263700kB [ 1146.371421][T16149] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1146.372001][T16149] Node 1 Normal: 2*4kB (M) 3*8kB (UM) 5*16kB (UM) 8*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 5*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950448kB [ 1146.372836][T16149] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1146.378412][T16149] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1146.378436][T16149] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1146.378473][T16149] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1146.378488][T16149] 46429 total pagecache pages [ 1146.378495][T16149] 0 pages in swap cache [ 1146.378573][T16149] Free swap = 124996kB [ 1146.378581][T16149] Total swap = 124996kB [ 1146.378753][T16149] 2097051 pages RAM [ 1146.378761][T16149] 0 pages HighMem/MovableOnly [ 1146.378768][T16149] 432783 pages reserved [ 1146.378775][T16149] 0 pages cma reserved [ 1149.653319][T16166] syzkaller0: entered promiscuous mode [ 1149.653341][T16166] syzkaller0: entered allmulticast mode [ 1149.756504][T16172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1149.756842][T16172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.794819][T16170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1149.795145][T16170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.875953][ T10] hid-generic 0000:0000:0000.0060: unknown main item tag 0x0 [ 1149.885426][ T10] hid-generic 0000:0000:0000.0060: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1150.649077][T16185] netlink: 'syz.0.2907': attribute type 2 has an invalid length. [ 1151.804555][T16193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1151.809428][T16193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1152.466779][T16203] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16203 comm=syz.1.2912 [ 1153.301007][T16213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1153.301648][T16213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1154.028008][ T31] audit: type=1400 audit(1789345228.847:309): avc: denied { read write } for pid=16217 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1154.028717][ T31] audit: type=1400 audit(1789345228.847:310): avc: denied { open } for pid=16217 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1154.073941][ T5602] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1154.075875][ T5602] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1154.076674][ T5602] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1154.077939][ T5602] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1154.078343][ T5602] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1156.027147][T16235] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1156.059029][T16235] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1156.096698][ T5702] usb 4-1: USB disconnect, device number 3 [ 1156.103552][ T5602] Bluetooth: hci5: command tx timeout [ 1157.871946][ T7035] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.025658][ T7035] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.124681][T16248] warn_alloc: 1 callbacks suppressed [ 1158.124724][T16248] syz.1.2920: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1158.124921][T16248] CPU: 1 UID: 0 PID: 16248 Comm: syz.1.2920 Not tainted syzkaller #0 PREEMPT(full) [ 1158.124944][T16248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1158.124956][T16248] Call Trace: [ 1158.124964][T16248] [ 1158.124972][T16248] dump_stack_lvl+0x100/0x190 [ 1158.125008][T16248] warn_alloc.cold+0x9e/0xb2 [ 1158.125031][T16248] ? __pfx_warn_alloc+0x10/0x10 [ 1158.125067][T16248] ? __schedule+0x126b/0x6920 [ 1158.125105][T16248] __vmalloc_node_range_noprof+0x123b/0x1420 [ 1158.125138][T16248] ? rcu_is_watching+0x13/0xc0 [ 1158.125165][T16248] ? trace_contention_end+0x126/0x160 [ 1158.125192][T16248] ? dvb_demux_do_ioctl+0x929/0x1200 [ 1158.125216][T16248] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1158.125237][T16248] ? irqentry_exit+0x24d/0xa10 [ 1158.125266][T16248] ? __pfx___mutex_lock+0x10/0x10 [ 1158.125293][T16248] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1158.125330][T16248] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1158.125350][T16248] __vmalloc_node_noprof+0xad/0xf0 [ 1158.125376][T16248] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1158.125399][T16248] dvb_demux_do_ioctl+0x9e0/0x1200 [ 1158.125420][T16248] ? do_vfs_ioctl+0x226/0x13e0 [ 1158.125444][T16248] dvb_usercopy+0x167/0x340 [ 1158.125473][T16248] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1158.125495][T16248] ? __pfx_dvb_usercopy+0x10/0x10 [ 1158.125523][T16248] ? __fget_files+0x34/0x3d0 [ 1158.125557][T16248] ? selinux_file_ioctl+0x13b/0x290 [ 1158.125579][T16248] ? selinux_file_ioctl+0xb6/0x290 [ 1158.125605][T16248] dvb_demux_ioctl+0x29/0x40 [ 1158.125635][T16248] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1158.125665][T16248] __x64_sys_ioctl+0x18e/0x210 [ 1158.125688][T16248] do_syscall_64+0x123/0x790 [ 1158.125715][T16248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.125736][T16248] RIP: 0033:0x7fd946f9e159 [ 1158.125754][T16248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1158.125772][T16248] RSP: 002b:00007fd947e79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1158.125791][T16248] RAX: ffffffffffffffda RBX: 00007fd947226090 RCX: 00007fd946f9e159 [ 1158.125804][T16248] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 000000000000000c [ 1158.125817][T16248] RBP: 00007fd94703503b R08: 0000000000000000 R09: 0000000000000000 [ 1158.125828][T16248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1158.125839][T16248] R13: 00007fd947226128 R14: 00007fd947226090 R15: 00007ffffc9b97c8 [ 1158.125866][T16248] [ 1158.125926][T16248] Mem-Info: [ 1158.125964][T16248] active_anon:9288 inactive_anon:0 isolated_anon:0 [ 1158.125964][T16248] active_file:0 inactive_file:45902 isolated_file:0 [ 1158.125964][T16248] unevictable:0 dirty:625 writeback:0 [ 1158.125964][T16248] slab_reclaimable:12410 slab_unreclaimable:98597 [ 1158.125964][T16248] mapped:30405 shmem:544 pagetables:2074 [ 1158.125964][T16248] sec_pagetables:0 bounce:0 [ 1158.125964][T16248] kernel_misc_reclaimable:0 [ 1158.125964][T16248] free:1313000 free_pcp:8932 free_cma:0 [ 1158.126043][T16248] Node 0 active_anon:37152kB inactive_anon:0kB active_file:0kB inactive_file:183404kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121620kB dirty:2500kB writeback:0kB shmem:2176kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13448kB pagetables:8156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1158.126115][T16248] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1158.126208][T16248] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1158.126297][T16248] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 1158.126421][T16248] Node 0 DMA32 free:1286192kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:37152kB inactive_anon:0kB active_file:0kB inactive_file:183404kB unevictable:0kB writepending:2500kB zspages:0kB present:3129332kB managed:2530536kB mlocked:0kB bounce:0kB free_pcp:35728kB local_pcp:20388kB free_cma:0kB [ 1158.126523][T16248] lowmem_reserve[]: 0 0 0 0 0 [ 1158.126935][T16248] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1158.127023][T16248] lowmem_reserve[]: 0 0 0 0 0 [ 1158.127268][T16248] Node 1 Normal free:3950448kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1158.127382][T16248] lowmem_reserve[]: 0 0 0 0 0 [ 1158.127846][T16248] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1158.128528][T16248] Node 0 DMA32: 1916*4kB (UM) 970*8kB (UME) 391*16kB (UM) 470*32kB (UME) 93*64kB (UME) 51*128kB (UME) 30*256kB (UME) 27*512kB (UME) 17*1024kB (UM) 5*2048kB (UE) 290*4096kB (UM) = 1286192kB [ 1158.129089][T16248] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1158.129625][T16248] Node 1 Normal: 2*4kB (M) 3*8kB (UM) 5*16kB (UM) 8*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 5*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950448kB [ 1158.130186][T16248] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1158.130228][T16248] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1158.130245][T16248] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1158.130282][T16248] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1158.130324][T16248] 46442 total pagecache pages [ 1158.130378][T16248] 0 pages in swap cache [ 1158.130385][T16248] Free swap = 124996kB [ 1158.130422][T16248] Total swap = 124996kB [ 1158.130461][T16248] 2097051 pages RAM [ 1158.130516][T16248] 0 pages HighMem/MovableOnly [ 1158.130524][T16248] 432783 pages reserved [ 1158.130598][T16248] 0 pages cma reserved [ 1158.184409][ T5602] Bluetooth: hci5: command tx timeout [ 1159.399012][T16249] syz.2.2921 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1159.399035][T16249] CPU: 1 UID: 0 PID: 16249 Comm: syz.2.2921 Not tainted syzkaller #0 PREEMPT(full) [ 1159.399050][T16249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1159.399058][T16249] Call Trace: [ 1159.399063][T16249] [ 1159.399069][T16249] dump_stack_lvl+0x100/0x190 [ 1159.399090][T16249] dump_header+0xfb/0x606 [ 1159.399103][T16249] oom_kill_process.cold+0xd/0x380 [ 1159.399120][T16249] out_of_memory+0x340/0x14f0 [ 1159.399139][T16249] ? __pfx_out_of_memory+0x10/0x10 [ 1159.399161][T16249] mem_cgroup_out_of_memory+0xc6/0x130 [ 1159.399176][T16249] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1159.399188][T16249] ? find_held_lock+0x2b/0x80 [ 1159.399208][T16249] ? do_raw_spin_unlock+0x145/0x1e0 [ 1159.399223][T16249] ? _raw_spin_unlock+0x28/0x50 [ 1159.399239][T16249] try_charge_memcg+0x783/0xf60 [ 1159.399259][T16249] ? __pfx_try_charge_memcg+0x10/0x10 [ 1159.399275][T16249] ? find_held_lock+0x2b/0x80 [ 1159.399290][T16249] ? rcu_read_unlock+0x17/0x60 [ 1159.399306][T16249] ? rcu_read_unlock+0x17/0x60 [ 1159.399326][T16249] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 1159.399348][T16249] ? kasan_save_track+0x14/0x30 [ 1159.399362][T16249] kmem_cache_alloc_noprof+0x4fa/0x6a0 [ 1159.399375][T16249] ? alloc_empty_file+0x5b/0x1c0 [ 1159.399393][T16249] alloc_empty_file+0x5b/0x1c0 [ 1159.399409][T16249] path_openat+0xdb/0x2440 [ 1159.399425][T16249] ? __pfx_path_openat+0x10/0x10 [ 1159.399442][T16249] do_file_open+0x20e/0x430 [ 1159.399457][T16249] ? __pfx_do_file_open+0x10/0x10 [ 1159.399481][T16249] ? _raw_spin_unlock+0x28/0x50 [ 1159.399493][T16249] ? alloc_fd+0x471/0x7a0 [ 1159.399511][T16249] do_sys_openat2+0x10f/0x1e0 [ 1159.399526][T16249] ? __pfx_do_sys_openat2+0x10/0x10 [ 1159.399546][T16249] __x64_sys_openat+0x12d/0x210 [ 1159.399561][T16249] ? __pfx___x64_sys_openat+0x10/0x10 [ 1159.399582][T16249] do_syscall_64+0x123/0x790 [ 1159.399598][T16249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1159.399610][T16249] RIP: 0033:0x7f5cc4d9e159 [ 1159.399620][T16249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1159.399631][T16249] RSP: 002b:00007f5cc2fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1159.399642][T16249] RAX: ffffffffffffffda RBX: 00007f5cc5026090 RCX: 00007f5cc4d9e159 [ 1159.399652][T16249] RDX: 0000000000000002 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 1159.399660][T16249] RBP: 00007f5cc4e3503b R08: 0000000000000000 R09: 0000000000000000 [ 1159.399667][T16249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1159.399675][T16249] R13: 00007f5cc5026128 R14: 00007f5cc5026090 R15: 00007ffc643e7ff8 [ 1159.399691][T16249] [ 1159.399711][T16249] memory: usage 4kB, limit 4kB, failcnt 1313 [ 1159.399718][T16249] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1159.399725][T16249] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1159.399732][T16249] Memory cgroup stats for /syz2/syz2: [ 1159.399798][T16249] cache 0 [ 1159.399803][T16249] rss 0 [ 1159.399808][T16249] rss_huge 0 [ 1159.399813][T16249] shmem 0 [ 1159.399817][T16249] mapped_file 0 [ 1159.399822][T16249] dirty 0 [ 1159.399826][T16249] writeback 0 [ 1159.399844][T16249] workingset_refault_anon 2 [ 1159.399849][T16249] workingset_refault_file 0 [ 1159.399854][T16249] swap 0 [ 1159.399858][T16249] swapcached 163840 [ 1159.399863][T16249] pgpgin 41 [ 1159.399868][T16249] pgpgout 6173 [ 1159.399872][T16249] pgfault 10466 [ 1159.399876][T16249] pgmajfault 2 [ 1159.399881][T16249] inactive_anon 0 [ 1159.399885][T16249] active_anon 0 [ 1159.399889][T16249] inactive_file 0 [ 1159.399893][T16249] active_file 0 [ 1159.399897][T16249] unevictable 0 [ 1159.399901][T16249] hierarchical_memory_limit 4096 [ 1159.399906][T16249] hierarchical_memsw_limit 9223372036854771712 [ 1159.399911][T16249] total_cache 0 [ 1159.399915][T16249] total_rss 0 [ 1159.399919][T16249] total_rss_huge 0 [ 1159.399923][T16249] total_shmem 0 [ 1159.399927][T16249] total_mapped_file 0 [ 1159.399932][T16249] total_dirty 0 [ 1159.399936][T16249] total_writeback 0 [ 1159.399940][T16249] total_workingset_refault_anon 2 [ 1159.399945][T16249] total_workingset_refault_file 0 [ 1159.399949][T16249] total_swap 0 [ 1159.399953][T16249] total_swapcached 163840 [ 1159.399958][T16249] total_pgpgin 41 [ 1159.399962][T16249] total_pgpgout 6173 [ 1159.399978][T16249] total_pgfault 10466 [ 1159.399983][T16249] total_pgmajfault 2 [ 1159.399987][T16249] total_inactive_anon 0 [ 1159.399991][T16249] total_active_anon 0 [ 1159.399996][T16249] total_inactive_file 0 [ 1159.400000][T16249] total_active_file 0 [ 1159.400004][T16249] total_unevictable 0 [ 1159.400008][T16249] anon_cost 0 [ 1159.400012][T16249] file_cost 0 [ 1159.400016][T16249] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2/syz2,task_memcg=/syz2/syz2,task=syz.2.2921,pid=16246,uid=0 [ 1159.400081][T16249] Memory cgroup out of memory: Killed process 16246 (syz.2.2921) total-vm:104564kB, anon-rss:1444kB, file-rss:22752kB, shmem-rss:0kB, UID:0 pgtables:152kB oom_score_adj:1000 [ 1159.660137][ T5695] hid-generic 0000:0000:0000.0061: unknown main item tag 0x0 [ 1159.667634][ T5695] hid-generic 0000:0000:0000.0061: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1159.741879][T16264] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16264 comm=syz.4.2923 [ 1159.786940][ T7035] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1159.796605][T16266] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16266 comm=syz.1.2924 [ 1160.122985][ T7035] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1160.264169][ T5602] Bluetooth: hci5: command tx timeout [ 1160.551469][ T10] hid-generic 0000:0000:0000.0062: unknown main item tag 0x0 [ 1160.558724][ T10] hid-generic 0000:0000:0000.0062: hidraw1: HID v0.00 Device [syz1] on syz0 [ 1160.766529][T16269] netlink: 'syz.0.2922': attribute type 2 has an invalid length. [ 1161.383988][ T7035] bridge_slave_1: left allmulticast mode [ 1161.384997][ T7035] bridge_slave_1: left promiscuous mode [ 1161.477047][ T7035] bridge0: port 2(bridge_slave_1) entered disabled state [ 1161.542489][T16294] netlink: 'syz.4.2927': attribute type 2 has an invalid length. [ 1161.947672][ T7035] bridge_slave_0: left allmulticast mode [ 1161.948620][ T7035] bridge_slave_0: left promiscuous mode [ 1161.994886][ T7035] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.342913][ T5602] Bluetooth: hci5: command tx timeout [ 1164.144929][ T31] audit: type=1400 audit(1789345238.967:311): avc: denied { allowed } for pid=16303 comm="syz.4.2931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1164.224650][T16308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.227389][T16308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.322038][ T7035] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1164.347660][ T7035] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1164.354189][ T7035] bond0 (unregistering): Released all slaves [ 1164.568642][ T31] audit: type=1400 audit(1789345239.387:312): avc: denied { write } for pid=16296 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1164.598943][T16217] bridge0: port 1(bridge_slave_0) entered blocking state [ 1164.603191][T16217] bridge0: port 1(bridge_slave_0) entered disabled state [ 1164.610561][T16217] bridge_slave_0: entered allmulticast mode [ 1164.633615][T16217] bridge_slave_0: entered promiscuous mode [ 1164.662351][T16217] bridge0: port 2(bridge_slave_1) entered blocking state [ 1164.662469][T16217] bridge0: port 2(bridge_slave_1) entered disabled state [ 1164.662592][T16217] bridge_slave_1: entered allmulticast mode [ 1164.674451][T16217] bridge_slave_1: entered promiscuous mode [ 1164.913168][ T31] audit: type=1400 audit(1789345239.727:313): avc: denied { write } for pid=16324 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1164.956505][ T31] audit: type=1400 audit(1789345239.777:314): avc: denied { create } for pid=16322 comm="syz.2.2932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1165.968393][ T31] audit: type=1400 audit(1789345240.787:315): avc: denied { read } for pid=16327 comm="syz.4.2933" name="usbmon0" dev="devtmpfs" ino=715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1165.968669][ T31] audit: type=1400 audit(1789345240.787:316): avc: denied { open } for pid=16327 comm="syz.4.2933" path="/dev/usbmon0" dev="devtmpfs" ino=715 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1166.103561][T16217] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1166.127669][T16217] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1166.337357][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1166.636835][T16337] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16337 comm=syz.2.2935 [ 1167.208409][T16217] team0: Port device team_slave_0 added [ 1167.230118][T16217] team0: Port device team_slave_1 added [ 1168.198230][T16217] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1168.198257][T16217] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1168.198301][T16217] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1168.416933][T16349] syz.2.2938: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1168.417099][T16349] CPU: 0 UID: 0 PID: 16349 Comm: syz.2.2938 Not tainted syzkaller #0 PREEMPT(full) [ 1168.417125][T16349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1168.417138][T16349] Call Trace: [ 1168.417145][T16349] [ 1168.417155][T16349] dump_stack_lvl+0x100/0x190 [ 1168.417190][T16349] warn_alloc.cold+0x9e/0xb2 [ 1168.417212][T16349] ? __pfx_warn_alloc+0x10/0x10 [ 1168.417250][T16349] ? rcu_is_watching+0x13/0xc0 [ 1168.417288][T16349] __vmalloc_node_range_noprof+0x123b/0x1420 [ 1168.417315][T16349] ? rcu_is_watching+0x13/0xc0 [ 1168.417341][T16349] ? trace_contention_end+0x126/0x160 [ 1168.417372][T16349] ? dvb_demux_do_ioctl+0x929/0x1200 [ 1168.417392][T16349] ? kasan_quarantine_put+0x104/0x240 [ 1168.417415][T16349] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1168.417438][T16349] ? __pfx___mutex_lock+0x10/0x10 [ 1168.417464][T16349] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1168.417493][T16349] ? tomoyo_path_number_perm+0x188/0x580 [ 1168.417517][T16349] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1168.417536][T16349] __vmalloc_node_noprof+0xad/0xf0 [ 1168.417559][T16349] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1168.417582][T16349] dvb_demux_do_ioctl+0x9e0/0x1200 [ 1168.417605][T16349] ? do_vfs_ioctl+0x226/0x13e0 [ 1168.417629][T16349] dvb_usercopy+0x167/0x340 [ 1168.417656][T16349] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1168.417678][T16349] ? __pfx_dvb_usercopy+0x10/0x10 [ 1168.417705][T16349] ? __fget_files+0x34/0x3d0 [ 1168.417740][T16349] ? selinux_file_ioctl+0x13b/0x290 [ 1168.417762][T16349] ? selinux_file_ioctl+0xb6/0x290 [ 1168.417786][T16349] dvb_demux_ioctl+0x29/0x40 [ 1168.417813][T16349] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1168.417843][T16349] __x64_sys_ioctl+0x18e/0x210 [ 1168.417864][T16349] do_syscall_64+0x123/0x790 [ 1168.417893][T16349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1168.417914][T16349] RIP: 0033:0x7f5cc4d9e159 [ 1168.417931][T16349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1168.417948][T16349] RSP: 002b:00007f5cc2fb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1168.417967][T16349] RAX: ffffffffffffffda RBX: 00007f5cc5026180 RCX: 00007f5cc4d9e159 [ 1168.417980][T16349] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 000000000000000c [ 1168.417990][T16349] RBP: 00007f5cc4e3503b R08: 0000000000000000 R09: 0000000000000000 [ 1168.418001][T16349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1168.418012][T16349] R13: 00007f5cc5026218 R14: 00007f5cc5026180 R15: 00007ffc643e7ff8 [ 1168.418039][T16349] [ 1168.418121][T16349] Mem-Info: [ 1168.418180][T16349] active_anon:10213 inactive_anon:0 isolated_anon:0 [ 1168.418180][T16349] active_file:0 inactive_file:45971 isolated_file:0 [ 1168.418180][T16349] unevictable:0 dirty:265 writeback:0 [ 1168.418180][T16349] slab_reclaimable:12562 slab_unreclaimable:98827 [ 1168.418180][T16349] mapped:30468 shmem:1500 pagetables:2027 [ 1168.418180][T16349] sec_pagetables:0 bounce:0 [ 1168.418180][T16349] kernel_misc_reclaimable:0 [ 1168.418180][T16349] free:1310932 free_pcp:10033 free_cma:0 [ 1168.418262][T16349] Node 0 active_anon:40852kB inactive_anon:0kB active_file:0kB inactive_file:183680kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121872kB dirty:1060kB writeback:0kB shmem:6000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13436kB pagetables:7968kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1168.418336][T16349] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1168.418443][T16349] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1168.418633][T16349] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 1168.418667][T16349] Node 0 DMA32 free:1277920kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:40852kB inactive_anon:0kB active_file:0kB inactive_file:183680kB unevictable:0kB writepending:1060kB zspages:0kB present:3129332kB managed:2530536kB mlocked:0kB bounce:0kB free_pcp:40132kB local_pcp:23656kB free_cma:0kB [ 1168.418835][T16349] lowmem_reserve[]: 0 0 0 0 0 [ 1168.418943][T16349] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1168.419065][T16349] lowmem_reserve[]: 0 0 0 0 0 [ 1168.419172][T16349] Node 1 Normal free:3950448kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1168.419365][T16349] lowmem_reserve[]: 0 0 0 0 0 [ 1168.419501][T16349] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1168.419933][T16349] Node 0 DMA32: 2622*4kB (UM) 412*8kB (UME) 218*16kB (UM) 359*32kB (UME) 72*64kB (UME) 49*128kB (UM) 29*256kB (UME) 30*512kB (UM) 17*1024kB (UM) 7*2048kB (UME) 289*4096kB (UM) = 1277912kB [ 1168.420626][T16349] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1168.421739][T16349] Node 1 Normal: 2*4kB (M) 3*8kB (UM) 5*16kB (UM) 8*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 5*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950448kB [ 1168.422591][T16349] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1168.422656][T16349] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1168.422741][T16349] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1168.441138][T16349] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1168.441191][T16349] 47453 total pagecache pages [ 1168.441226][T16349] 0 pages in swap cache [ 1168.441291][T16349] Free swap = 124996kB [ 1168.441325][T16349] Total swap = 124996kB [ 1168.441362][T16349] 2097051 pages RAM [ 1168.441425][T16349] 0 pages HighMem/MovableOnly [ 1168.441433][T16349] 432783 pages reserved [ 1168.441488][T16349] 0 pages cma reserved [ 1169.214579][T16217] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1169.214593][T16217] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1169.214613][T16217] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1170.903103][T16355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1170.905020][T16355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1170.957904][ T7035] hsr_slave_0: left promiscuous mode [ 1170.968286][ T7035] hsr_slave_1: left promiscuous mode [ 1170.968959][ T7035] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1170.968989][ T7035] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1171.046976][ T7035] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1171.046995][ T7035] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1171.144001][T16361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1171.146488][T16361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1171.160950][ T7035] veth1_macvtap: left promiscuous mode [ 1171.160992][ T7035] veth0_macvtap: left promiscuous mode [ 1171.161067][ T7035] veth1_vlan: left promiscuous mode [ 1171.161186][ T7035] veth0_vlan: left promiscuous mode [ 1171.699454][ T31] audit: type=1400 audit(1789345246.517:317): avc: denied { write } for pid=16360 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1171.704507][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1171.704571][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1171.837298][ T31] audit: type=1400 audit(1789345246.657:318): avc: denied { write } for pid=16379 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1173.415716][T16386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.416107][T16386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1173.420865][T16386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.421256][T16386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1173.450023][ T7035] team0 (unregistering): Port device team_slave_1 removed [ 1173.479397][T16386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.479715][T16386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1173.481230][T16390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.481548][T16390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1173.502238][ T7035] team0 (unregistering): Port device team_slave_0 removed [ 1173.801017][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1173.869676][T16217] hsr_slave_0: entered promiscuous mode [ 1173.873310][T16217] hsr_slave_1: entered promiscuous mode [ 1173.873793][T16217] debugfs: 'hsr0' already exists in 'hsr' [ 1173.873808][T16217] Cannot create hsr debugfs directory [ 1174.260820][T16403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1174.261157][T16403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1174.501197][ T7035] IPVS: stop unused estimator thread 0... [ 1177.638204][ T31] audit: type=1400 audit(1789345252.457:319): avc: denied { write } for pid=16401 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1178.747402][T16433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1178.790924][T16434] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1178.813779][T16433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1178.890343][T16434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1179.221629][T16434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1180.219900][T16436] xt_hashlimit: size too large, truncated to 1048576 [ 1180.278584][ T31] audit: type=1400 audit(1789345255.087:320): avc: denied { write } for pid=16437 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1180.777910][T16451] bridge0: adding interface bridge_slave_0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 1181.249615][ T31] audit: type=1400 audit(1789345256.057:321): avc: denied { write } for pid=16449 comm="syz.2.2955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1181.334499][ T31] audit: type=1400 audit(1789345256.147:322): avc: denied { listen } for pid=16449 comm="syz.2.2955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1182.151676][T16217] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1182.229056][T16217] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1182.232424][T16217] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1182.259563][T16217] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1182.262287][T16217] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1182.313639][T16217] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1182.314908][T16217] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1182.382983][ T31] audit: type=1400 audit(1789345257.207:323): avc: denied { setopt } for pid=16463 comm="syz.2.2957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1182.418989][T16217] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1182.431993][ T3337] af_packet: tpacket_rcv: packet too big, clamped from 52 to 4294967272. macoff=96 [ 1182.549553][ T31] audit: type=1400 audit(1789345257.367:324): avc: denied { read } for pid=16474 comm="syz.2.2960" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1182.550469][ T31] audit: type=1400 audit(1789345257.367:325): avc: denied { open } for pid=16474 comm="syz.2.2960" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1182.616285][ T31] audit: type=1400 audit(1789345257.437:326): avc: denied { ioctl } for pid=16474 comm="syz.2.2960" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1182.617565][T16478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1182.624251][T16478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1182.808142][T16217] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1182.887659][T16217] 8021q: adding VLAN 0 to HW filter on device team0 [ 1182.920520][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 1182.921348][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1183.009341][ T3337] bridge0: port 2(bridge_slave_1) entered blocking state [ 1183.009427][ T3337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1183.130613][ T31] audit: type=1400 audit(1789345257.947:327): avc: denied { ioctl } for pid=16493 comm="syz.0.2962" path="socket:[46956]" dev="sockfs" ino=46956 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1183.249901][ T31] audit: type=1400 audit(1789345258.067:328): avc: denied { listen } for pid=16493 comm="syz.0.2962" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1183.307100][ T31] audit: type=1400 audit(1789345258.127:329): avc: denied { bind } for pid=16492 comm="syz.2.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1183.415425][ T31] audit: type=1400 audit(1789345258.237:330): avc: denied { write } for pid=16492 comm="syz.2.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1183.699330][ T31] audit: type=1400 audit(1789345258.517:331): avc: denied { write } for pid=16462 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1184.069354][T16494] macvlan2: entered promiscuous mode [ 1184.404638][ T5602] Bluetooth: hci0: unexpected cc 0x204b length: 34 > 3 [ 1184.405530][ T5602] Bluetooth: hci0: unexpected event for opcode 0x204b [ 1184.436281][T16480] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1184.452054][ T31] audit: type=1400 audit(1789345259.267:332): avc: denied { shutdown } for pid=16503 comm="syz.1.2963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1184.458728][ T31] audit: type=1400 audit(1789345259.277:333): avc: denied { getopt } for pid=16503 comm="syz.1.2963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1184.458767][ T31] audit: type=1400 audit(1789345259.277:334): avc: denied { connect } for pid=16503 comm="syz.1.2963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1184.458797][ T31] audit: type=1400 audit(1789345259.277:335): avc: denied { name_connect } for pid=16503 comm="syz.1.2963" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 1184.485393][ T31] audit: type=1400 audit(1789345259.297:336): avc: denied { setopt } for pid=16503 comm="syz.1.2963" lport=52452 faddr=::ffff:10.1.1.2 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1184.741151][T16512] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1184.743327][T16512] CIFS: Attempting to mount //127.0.0.1/share [ 1185.561608][T16512] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1185.641501][T16517] netlink: 2088 bytes leftover after parsing attributes in process `syz.1.2966'. [ 1186.011016][T16529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1186.011359][T16529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1186.588523][T16557] warn_alloc: 2 callbacks suppressed [ 1186.588545][T16557] syz.2.2971: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1186.588758][T16557] CPU: 1 UID: 0 PID: 16557 Comm: syz.2.2971 Not tainted syzkaller #0 PREEMPT(full) [ 1186.588780][T16557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1186.588792][T16557] Call Trace: [ 1186.588800][T16557] [ 1186.588809][T16557] dump_stack_lvl+0x100/0x190 [ 1186.588844][T16557] warn_alloc.cold+0x9e/0xb2 [ 1186.588870][T16557] ? __pfx_warn_alloc+0x10/0x10 [ 1186.588904][T16557] ? avc_has_extended_perms+0x201/0x1080 [ 1186.588935][T16557] ? avc_has_extended_perms+0x33a/0x1080 [ 1186.588962][T16557] ? avc_has_extended_perms+0x33a/0x1080 [ 1186.588999][T16557] __vmalloc_node_range_noprof+0x123b/0x1420 [ 1186.589025][T16557] ? rcu_is_watching+0x13/0xc0 [ 1186.589052][T16557] ? trace_contention_end+0x126/0x160 [ 1186.589078][T16557] ? dvb_demux_do_ioctl+0x929/0x1200 [ 1186.589099][T16557] ? kasan_quarantine_put+0x104/0x240 [ 1186.589120][T16557] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1186.589142][T16557] ? __pfx___mutex_lock+0x10/0x10 [ 1186.589168][T16557] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1186.589193][T16557] ? preempt_schedule_irq+0x79/0x90 [ 1186.589224][T16557] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1186.589244][T16557] __vmalloc_node_noprof+0xad/0xf0 [ 1186.589270][T16557] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1186.589292][T16557] dvb_demux_do_ioctl+0x9e0/0x1200 [ 1186.589314][T16557] ? do_vfs_ioctl+0x226/0x13e0 [ 1186.589338][T16557] dvb_usercopy+0x167/0x340 [ 1186.589365][T16557] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1186.589387][T16557] ? __pfx_dvb_usercopy+0x10/0x10 [ 1186.589412][T16557] ? __fget_files+0x34/0x3d0 [ 1186.589446][T16557] ? selinux_file_ioctl+0x13b/0x290 [ 1186.589466][T16557] ? selinux_file_ioctl+0xb6/0x290 [ 1186.589490][T16557] dvb_demux_ioctl+0x29/0x40 [ 1186.589520][T16557] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1186.589550][T16557] __x64_sys_ioctl+0x18e/0x210 [ 1186.589571][T16557] do_syscall_64+0x123/0x790 [ 1186.589606][T16557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.589627][T16557] RIP: 0033:0x7f5cc4d9e159 [ 1186.589646][T16557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1186.589665][T16557] RSP: 002b:00007f5cc2fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1186.589686][T16557] RAX: ffffffffffffffda RBX: 00007f5cc5026090 RCX: 00007f5cc4d9e159 [ 1186.589700][T16557] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 000000000000000c [ 1186.589713][T16557] RBP: 00007f5cc4e3503b R08: 0000000000000000 R09: 0000000000000000 [ 1186.589726][T16557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1186.589737][T16557] R13: 00007f5cc5026128 R14: 00007f5cc5026090 R15: 00007ffc643e7ff8 [ 1186.589764][T16557] [ 1186.589826][T16557] Mem-Info: [ 1186.589897][T16557] active_anon:9440 inactive_anon:0 isolated_anon:0 [ 1186.589897][T16557] active_file:0 inactive_file:46166 isolated_file:0 [ 1186.589897][T16557] unevictable:0 dirty:622 writeback:0 [ 1186.589897][T16557] slab_reclaimable:12477 slab_unreclaimable:98237 [ 1186.589897][T16557] mapped:30800 shmem:532 pagetables:2130 [ 1186.589897][T16557] sec_pagetables:0 bounce:0 [ 1186.589897][T16557] kernel_misc_reclaimable:0 [ 1186.589897][T16557] free:1307998 free_pcp:12987 free_cma:0 [ 1186.589972][T16557] Node 0 active_anon:37760kB inactive_anon:0kB active_file:0kB inactive_file:184460kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:123200kB dirty:2488kB writeback:0kB shmem:2128kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13536kB pagetables:8380kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1186.590027][T16557] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1186.590114][T16557] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1186.590198][T16557] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 1186.590282][T16557] Node 0 DMA32 free:1283040kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:37760kB inactive_anon:0kB active_file:0kB inactive_file:184460kB unevictable:0kB writepending:2488kB zspages:0kB present:3129332kB managed:2530536kB mlocked:0kB bounce:0kB free_pcp:35092kB local_pcp:20676kB free_cma:0kB [ 1186.590451][T16557] lowmem_reserve[]: 0 0 0 0 0 [ 1186.590536][T16557] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1186.590623][T16557] lowmem_reserve[]: 0 0 0 0 0 [ 1186.590802][T16557] Node 1 Normal free:3933592kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:16856kB local_pcp:7600kB free_cma:0kB [ 1186.590937][T16557] lowmem_reserve[]: 0 0 0 0 0 [ 1186.591065][T16557] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1186.591417][T16557] Node 0 DMA32: 1436*4kB (UM) 752*8kB (UM) 385*16kB (UME) 521*32kB (UME) 117*64kB (UME) 51*128kB (UME) 32*256kB (UME) 27*512kB (UME) 18*1024kB (UME) 3*2048kB (UM) 290*4096kB (UM) = 1283040kB [ 1186.592004][T16557] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1186.592438][T16557] Node 1 Normal: 0*4kB 1*8kB (U) 1*16kB (U) 0*32kB 2*64kB (UM) 2*128kB (UM) 2*256kB (UM) 1*512kB (M) 0*1024kB 2*2048kB (UM) 959*4096kB (M) = 3933592kB [ 1186.598259][T16557] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1186.598287][T16557] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1186.598327][T16557] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1186.598390][T16557] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1186.598427][T16557] 46694 total pagecache pages [ 1186.598461][T16557] 0 pages in swap cache [ 1186.598520][T16557] Free swap = 124996kB [ 1186.598554][T16557] Total swap = 124996kB [ 1186.598591][T16557] 2097051 pages RAM [ 1186.598641][T16557] 0 pages HighMem/MovableOnly [ 1186.598650][T16557] 432783 pages reserved [ 1186.598684][T16557] 0 pages cma reserved [ 1187.895181][T16217] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1188.092414][T16564] ======================================================= [ 1188.092414][T16564] WARNING: The mand mount option has been deprecated and [ 1188.092414][T16564] and is ignored by this kernel. Remove the mand [ 1188.092414][T16564] option from the mount to silence this warning. [ 1188.092414][T16564] ======================================================= [ 1188.092460][T16564] Device name not specified. [ 1188.092460][T16564] [ 1188.168023][T16217] veth0_vlan: entered promiscuous mode [ 1188.181713][T16217] veth1_vlan: entered promiscuous mode [ 1188.198002][T16566] fuse: Bad value for 'user_id' [ 1188.198022][T16566] fuse: Bad value for 'user_id' [ 1188.247423][ T31] kauditd_printk_skb: 16 callbacks suppressed [ 1188.247440][ T31] audit: type=1400 audit(1789345263.067:353): avc: denied { write } for pid=16567 comm="syz.2.2973" name="instances" dev="tracefs" ino=840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1188.247863][T16217] veth0_macvtap: entered promiscuous mode [ 1188.269784][ T31] audit: type=1400 audit(1789345263.077:354): avc: denied { add_name } for pid=16567 comm="syz.2.2973" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 1188.269829][ T31] audit: type=1400 audit(1789345263.077:355): avc: denied { create } for pid=16567 comm="syz.2.2973" name="foo" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 1188.331612][T16217] veth1_macvtap: entered promiscuous mode [ 1188.352377][T16217] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1188.371839][T16217] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1188.424063][ T5602] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 1188.424401][ T5602] Bluetooth: hci0: Injecting HCI hardware error event [ 1188.425234][ T5609] Bluetooth: hci0: hardware error 0x00 [ 1188.463818][ T6481] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.471280][ T3337] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.471319][ T3337] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.471346][ T3337] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.526211][ T31] audit: type=1400 audit(1789345263.347:356): avc: denied { write } for pid=16565 comm="syz.4.2974" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1188.527149][ T31] audit: type=1400 audit(1789345263.347:357): avc: denied { open } for pid=16565 comm="syz.4.2974" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1188.528309][ T31] audit: type=1400 audit(1789345263.347:358): avc: denied { ioctl } for pid=16565 comm="syz.4.2974" path="/dev/ppp" dev="devtmpfs" ino=708 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1188.550335][ T31] audit: type=1400 audit(1789345263.357:359): avc: denied { create } for pid=16582 comm="syz.0.2976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1188.587003][ T31] audit: type=1400 audit(1789345263.397:360): avc: denied { write } for pid=16582 comm="syz.0.2976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1188.650369][ T3337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1188.650389][ T3337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1188.700135][ T31] audit: type=1400 audit(1789345263.517:361): avc: denied { setopt } for pid=16582 comm="syz.0.2976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1188.707948][T16586] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 1188.707963][T16586] overlayfs: missing 'lowerdir' [ 1188.775629][ T31] audit: type=1400 audit(1789345263.597:362): avc: denied { connect } for pid=16584 comm="syz.1.2977" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1188.799319][ T7034] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1188.799338][ T7034] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1190.503933][ T5609] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1191.663596][T16604] vlan2: entered promiscuous mode [ 1191.663616][T16604] bridge0: entered promiscuous mode [ 1191.861405][T16609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2981'. [ 1193.117452][ T10] usb 5-1: USB disconnect, device number 2 [ 1193.235003][T16629] CIFS: Attempting to mount //127.0.0.1/share [ 1193.295147][T16632] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2988'. [ 1193.308518][T16631] CIFS: VFS: Invalid response size 0 for command 0 [ 1193.320885][ T31] kauditd_printk_skb: 16 callbacks suppressed [ 1193.320901][ T31] audit: type=1400 audit(1789345268.137:379): avc: denied { create } for pid=16630 comm="syz.2.2988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1193.323126][ T31] audit: type=1400 audit(1789345268.137:380): avc: denied { bind } for pid=16630 comm="syz.2.2988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1193.333356][T16629] CIFS: VFS: cifs_mount failed w/return code = -5 [ 1193.419967][ T31] audit: type=1400 audit(1789345268.237:381): avc: denied { write } for pid=16630 comm="syz.2.2988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1193.457247][T16639] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1193.460237][T16639] futex_wake_op: syz.1.2989 tries to shift op by 144; fix this program [ 1193.460445][T16639] futex_wake_op: syz.1.2989 tries to shift op by 144; fix this program [ 1193.462913][ T31] audit: type=1400 audit(1789345268.277:382): avc: denied { ioctl } for pid=16638 comm="syz.1.2989" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1193.608280][ T5602] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1193.610311][ T5602] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1193.612460][ T5602] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1193.613519][ T5602] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1193.613940][ T5602] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1194.692067][ T31] audit: type=1400 audit(1789345269.487:383): avc: denied { mount } for pid=16646 comm="syz.0.2992" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1194.692112][ T31] audit: type=1400 audit(1789345269.507:384): avc: denied { mount } for pid=16646 comm="syz.0.2992" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1194.819829][ T31] audit: type=1400 audit(1789345269.637:385): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1195.082371][ T31] audit: type=1400 audit(1789345269.897:386): avc: denied { write } for pid=16628 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1195.421028][ T31] audit: type=1400 audit(1789345270.237:387): avc: denied { write } for pid=16676 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1195.625046][ T5609] Bluetooth: hci1: command tx timeout [ 1195.631397][ T181] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1195.870607][ T181] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.002940][ T181] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.162088][ T181] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1197.295249][T16693] syz.3.2998 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=1000 [ 1197.295326][T16693] CPU: 0 UID: 0 PID: 16693 Comm: syz.3.2998 Not tainted syzkaller #0 PREEMPT(full) [ 1197.295348][T16693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1197.295360][T16693] Call Trace: [ 1197.295368][T16693] [ 1197.295377][T16693] dump_stack_lvl+0x100/0x190 [ 1197.295425][T16693] dump_header+0xfb/0x606 [ 1197.295451][T16693] oom_kill_process.cold+0xd/0x380 [ 1197.295478][T16693] out_of_memory+0x340/0x14f0 [ 1197.295511][T16693] ? __pfx_out_of_memory+0x10/0x10 [ 1197.295545][T16693] mem_cgroup_out_of_memory+0xc6/0x130 [ 1197.295568][T16693] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1197.295589][T16693] ? find_held_lock+0x2b/0x80 [ 1197.295623][T16693] ? do_raw_spin_unlock+0x145/0x1e0 [ 1197.295649][T16693] ? _raw_spin_unlock+0x28/0x50 [ 1197.295674][T16693] try_charge_memcg+0x783/0xf60 [ 1197.295709][T16693] ? __pfx_try_charge_memcg+0x10/0x10 [ 1197.295738][T16693] ? find_held_lock+0x2b/0x80 [ 1197.295765][T16693] ? rcu_read_unlock+0x17/0x60 [ 1197.295793][T16693] ? rcu_read_unlock+0x17/0x60 [ 1197.295830][T16693] obj_cgroup_charge_pages+0x22/0x1d0 [ 1197.295862][T16693] __memcg_kmem_charge_page+0x1c4/0x4d0 [ 1197.295891][T16693] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1197.295930][T16693] __alloc_frozen_pages_noprof+0x534/0x3300 [ 1197.295965][T16693] ? arch_stack_walk+0xa6/0xf0 [ 1197.295998][T16693] ? __lock_acquire+0x5c0/0x1f40 [ 1197.296024][T16693] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1197.296055][T16693] ? __pfx_stack_trace_save+0x10/0x10 [ 1197.296074][T16693] ? stack_depot_save_flags+0x27/0x9f0 [ 1197.296103][T16693] ? lock_acquire+0x1d1/0x380 [ 1197.296124][T16693] ? __update_page_owner_handle+0x63/0x530 [ 1197.296156][T16693] ? __lock_acquire+0x5c0/0x1f40 [ 1197.296182][T16693] ? __update_page_owner_handle+0x390/0x530 [ 1197.296217][T16693] ? lock_acquire+0x1d1/0x380 [ 1197.296236][T16693] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1197.296259][T16693] ? policy_nodemask+0xed/0x4f0 [ 1197.296286][T16693] alloc_pages_mpol+0x201/0x550 [ 1197.296314][T16693] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1197.296342][T16693] ? prep_compound_page+0x280/0x570 [ 1197.296372][T16693] alloc_pages_noprof+0x1a/0x160 [ 1197.296408][T16693] pte_alloc_one+0x1c/0x3d0 [ 1197.296438][T16693] do_huge_pmd_anonymous_page+0x8c8/0x15b0 [ 1197.296464][T16693] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 1197.296495][T16693] ? __pfx_do_huge_pmd_anonymous_page+0x10/0x10 [ 1197.296516][T16693] ? pgd_none+0x9f/0xe0 [ 1197.296543][T16693] ? __pfx_pgd_none+0x10/0x10 [ 1197.296572][T16693] ? find_held_lock+0x2b/0x80 [ 1197.296604][T16693] __handle_mm_fault+0x2134/0x2f60 [ 1197.296640][T16693] ? __pfx___handle_mm_fault+0x10/0x10 [ 1197.296666][T16693] ? __pfx_mt_find+0x10/0x10 [ 1197.296712][T16693] ? find_vma+0xbf/0x140 [ 1197.296734][T16693] ? __pfx_find_vma+0x10/0x10 [ 1197.296759][T16693] handle_mm_fault+0x363/0xa20 [ 1197.296792][T16693] do_user_addr_fault+0x745/0x12f0 [ 1197.296827][T16693] exc_page_fault+0x6f/0xd0 [ 1197.296855][T16693] asm_exc_page_fault+0x26/0x30 [ 1197.296876][T16693] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1197.296897][T16693] Code: cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 7f b1 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1197.296911][T16693] RSP: 0000:ffffc90002dcf948 EFLAGS: 00050206 [ 1197.296927][T16693] RAX: 0000000000000001 RBX: ffff888038e68000 RCX: 0000000000000140 [ 1197.296939][T16693] RDX: 0000000000000001 RSI: 0000200000600000 RDI: ffff888038e6fec0 [ 1197.296951][T16693] RBP: 00002000005f8140 R08: 0000000000000001 R09: ffffed10071cdfff [ 1197.296964][T16693] R10: ffff888038e6ffff R11: 0000000000000000 R12: ffffc90002dcfc58 [ 1197.296977][T16693] R13: 00000000005f8000 R14: 0000000000008000 R15: 0000000000000000 [ 1197.297005][T16693] _copy_from_iter+0x355/0x1690 [ 1197.297036][T16693] ? __pfx__copy_from_iter+0x10/0x10 [ 1197.297058][T16693] ? alloc_pages_noprof+0xf9/0x160 [ 1197.297086][T16693] ? skb_page_frag_refill+0x309/0x4b0 [ 1197.297111][T16693] ? sk_page_frag_refill+0x6c/0x340 [ 1197.297135][T16693] kcm_sendmsg+0x1447/0x3120 [ 1197.297181][T16693] ? __pfx_kcm_sendmsg+0x10/0x10 [ 1197.297210][T16693] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1197.297236][T16693] sock_write_iter+0x53a/0x5b0 [ 1197.297265][T16693] ? __pfx_kcm_sendmsg+0x10/0x10 [ 1197.297291][T16693] ? __pfx_sock_write_iter+0x10/0x10 [ 1197.297328][T16693] ? bpf_lsm_file_permission+0x9/0x10 [ 1197.297353][T16693] ? security_file_permission+0x76/0x210 [ 1197.297378][T16693] ? rw_verify_area+0xce/0x6d0 [ 1197.297417][T16693] vfs_write+0x6af/0x1050 [ 1197.297438][T16693] ? __pfx_sock_write_iter+0x10/0x10 [ 1197.297469][T16693] ? __pfx_vfs_write+0x10/0x10 [ 1197.297487][T16693] ? find_held_lock+0x2b/0x80 [ 1197.297532][T16693] ksys_write+0x1f8/0x250 [ 1197.297552][T16693] ? __pfx_ksys_write+0x10/0x10 [ 1197.297580][T16693] do_syscall_64+0x123/0x790 [ 1197.297610][T16693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1197.297629][T16693] RIP: 0033:0x7f675d39e159 [ 1197.297646][T16693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1197.297664][T16693] RSP: 002b:00007f675e2f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1197.297683][T16693] RAX: ffffffffffffffda RBX: 00007f675d625fa0 RCX: 00007f675d39e159 [ 1197.297696][T16693] RDX: 00000000fffffdef RSI: 0000200000000140 RDI: 0000000000000004 [ 1197.297709][T16693] RBP: 00007f675d43503b R08: 0000000000000000 R09: 0000000000000000 [ 1197.297721][T16693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1197.297734][T16693] R13: 00007f675d626038 R14: 00007f675d625fa0 R15: 00007ffc46337eb8 [ 1197.297761][T16693] [ 1197.309834][T16693] memory: usage 4kB, limit 4kB, failcnt 1209 [ 1197.314644][T16693] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1197.314659][T16693] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1197.314669][T16693] Memory cgroup stats for /syz3/syz2: [ 1197.314764][T16693] cache 0 [ 1197.314772][T16693] rss 0 [ 1197.314778][T16693] rss_huge 0 [ 1197.314784][T16693] shmem 0 [ 1197.314790][T16693] mapped_file 0 [ 1197.314796][T16693] dirty 0 [ 1197.314802][T16693] writeback 0 [ 1197.314809][T16693] workingset_refault_anon 7 [ 1197.314816][T16693] workingset_refault_file 0 [ 1197.314823][T16693] swap 0 [ 1197.314828][T16693] swapcached 221184 [ 1197.314835][T16693] pgpgin 60 [ 1197.314841][T16693] pgpgout 6192 [ 1197.314847][T16693] pgfault 2330 [ 1197.314853][T16693] pgmajfault 3 [ 1197.314859][T16693] inactive_anon 0 [ 1197.314866][T16693] active_anon 0 [ 1197.314872][T16693] inactive_file 0 [ 1197.314878][T16693] active_file 0 [ 1197.314884][T16693] unevictable 0 [ 1197.314891][T16693] hierarchical_memory_limit 4096 [ 1197.314898][T16693] hierarchical_memsw_limit 9223372036854771712 [ 1197.314905][T16693] total_cache 0 [ 1197.314911][T16693] total_rss 0 [ 1197.314918][T16693] total_rss_huge 0 [ 1197.314924][T16693] total_shmem 0 [ 1197.314930][T16693] total_mapped_file 0 [ 1197.314937][T16693] total_dirty 0 [ 1197.314943][T16693] total_writeback 0 [ 1197.314950][T16693] total_workingset_refault_anon 7 [ 1197.314957][T16693] total_workingset_refault_file 0 [ 1197.314964][T16693] total_swap 0 [ 1197.314971][T16693] total_swapcached 221184 [ 1197.314977][T16693] total_pgpgin 60 [ 1197.314983][T16693] total_pgpgout 6192 [ 1197.314990][T16693] total_pgfault 2330 [ 1197.314996][T16693] total_pgmajfault 3 [ 1197.315003][T16693] total_inactive_anon 0 [ 1197.315009][T16693] total_active_anon 0 [ 1197.315015][T16693] total_inactive_file 0 [ 1197.315022][T16693] total_active_file 0 [ 1197.315028][T16693] total_unevictable 0 [ 1197.315035][T16693] anon_cost 0 [ 1197.315041][T16693] file_cost 0 [ 1197.315048][T16693] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/syz2,task_memcg=/syz3/syz2,task=syz.3.2998,pid=16692,uid=0 [ 1197.315161][T16693] Memory cgroup out of memory: Killed process 16692 (syz.3.2998) total-vm:104432kB, anon-rss:3480kB, file-rss:22688kB, shmem-rss:0kB, UID:0 pgtables:144kB oom_score_adj:1000 [ 1197.434037][ T31] audit: type=1400 audit(1789345272.237:388): avc: denied { create } for pid=16703 comm="syz.0.2993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1197.712949][ T5609] Bluetooth: hci1: command tx timeout [ 1197.892417][ T181] bridge_slave_1: left allmulticast mode [ 1197.892440][ T181] bridge_slave_1: left promiscuous mode [ 1197.892591][ T181] bridge0: port 2(bridge_slave_1) entered disabled state [ 1197.908996][ T181] bridge_slave_0: left allmulticast mode [ 1197.909017][ T181] bridge_slave_0: left promiscuous mode [ 1197.909154][ T181] bridge0: port 1(bridge_slave_0) entered disabled state [ 1198.047520][T16714] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1198.052656][T16717] FAULT_INJECTION: forcing a failure. [ 1198.052656][T16717] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1198.052682][T16717] CPU: 0 UID: 0 PID: 16717 Comm: syz.2.3004 Not tainted syzkaller #0 PREEMPT(full) [ 1198.052702][T16717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1198.052712][T16717] Call Trace: [ 1198.052718][T16717] [ 1198.052725][T16717] dump_stack_lvl+0x100/0x190 [ 1198.052756][T16717] should_fail_ex.cold+0x5/0xa [ 1198.052779][T16717] _copy_from_user+0x2e/0xd0 [ 1198.052798][T16717] video_usercopy+0xe71/0x1730 [ 1198.052822][T16717] ? __pfx___video_do_ioctl+0x10/0x10 [ 1198.052846][T16717] ? __pfx_video_usercopy+0x10/0x10 [ 1198.052881][T16717] v4l2_ioctl+0x1bd/0x250 [ 1198.052904][T16717] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1198.052933][T16717] __x64_sys_ioctl+0x18e/0x210 [ 1198.052952][T16717] do_syscall_64+0x123/0x790 [ 1198.052976][T16717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1198.052994][T16717] RIP: 0033:0x7f5cc4d9e159 [ 1198.053008][T16717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1198.053022][T16717] RSP: 002b:00007f5cc2ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1198.053039][T16717] RAX: ffffffffffffffda RBX: 00007f5cc5025fa0 RCX: 00007f5cc4d9e159 [ 1198.053050][T16717] RDX: 00002000000000c0 RSI: 00000000c050561a RDI: 0000000000000003 [ 1198.053060][T16717] RBP: 00007f5cc2ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1198.053070][T16717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1198.053080][T16717] R13: 00007f5cc5026038 R14: 00007f5cc5025fa0 R15: 00007ffc643e7ff8 [ 1198.053102][T16717] [ 1199.184073][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 1199.184091][ T31] audit: type=1400 audit(1789345274.007:392): avc: denied { write } for pid=16713 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1199.305514][ T181] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1199.323834][ T181] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1199.347113][ T181] bond0 (unregistering): Released all slaves [ 1199.729006][ T31] audit: type=1400 audit(1789345274.537:393): avc: denied { write } for pid=16742 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1199.796831][ T5609] Bluetooth: hci1: command tx timeout [ 1201.569111][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1201.569897][T16642] bridge0: port 1(bridge_slave_0) entered blocking state [ 1201.569972][T16642] bridge0: port 1(bridge_slave_0) entered disabled state [ 1201.570064][T16642] bridge_slave_0: entered allmulticast mode [ 1201.571197][T16642] bridge_slave_0: entered promiscuous mode [ 1201.586365][T16758] syz.2.3008 uses obsolete (PF_INET,SOCK_PACKET) [ 1201.593531][ T31] audit: type=1400 audit(1789345276.407:394): avc: denied { ioctl } for pid=16752 comm="syz.2.3008" path="socket:[48568]" dev="sockfs" ino=48568 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1201.639829][T16642] bridge0: port 2(bridge_slave_1) entered blocking state [ 1201.639907][T16642] bridge0: port 2(bridge_slave_1) entered disabled state [ 1201.640016][T16642] bridge_slave_1: entered allmulticast mode [ 1201.641772][T16642] bridge_slave_1: entered promiscuous mode [ 1201.722868][ T31] audit: type=1400 audit(1789345276.517:395): avc: denied { unlink } for pid=16754 comm="syz.0.3010" name="#1" dev="tmpfs" ino=3326 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1201.863075][ T5609] Bluetooth: hci1: command tx timeout [ 1201.964900][T16762] warning: `syz.2.3008' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 1202.000235][ T31] audit: type=1400 audit(1789345276.817:396): avc: denied { checkpoint_restore } for pid=16768 comm="syz.0.3011" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1202.026625][ T31] audit: type=1400 audit(1789345276.847:397): avc: denied { read } for pid=16768 comm="syz.0.3011" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1202.061827][ T181] hsr_slave_0: left promiscuous mode [ 1202.071699][ T181] hsr_slave_1: left promiscuous mode [ 1202.072554][ T181] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1202.072571][ T181] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1202.097172][ T181] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1202.097192][ T181] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1202.146955][ T181] veth1_macvtap: left promiscuous mode [ 1202.146982][ T181] veth0_macvtap: left promiscuous mode [ 1202.147026][ T181] veth1_vlan: left promiscuous mode [ 1202.147056][ T181] veth0_vlan: left promiscuous mode [ 1202.847877][ T31] audit: type=1400 audit(1789345277.527:398): avc: denied { bind } for pid=16779 comm="syz.3.3013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1203.062878][ T31] audit: type=1400 audit(1789345277.607:399): avc: denied { listen } for pid=16779 comm="syz.3.3013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1203.062920][ T31] audit: type=1400 audit(1789345277.787:400): avc: denied { setopt } for pid=16779 comm="syz.3.3013" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1203.201246][ T181] team0 (unregistering): Port device team_slave_1 removed [ 1203.225370][ T181] team0 (unregistering): Port device team_slave_0 removed [ 1203.401755][T16758] tipc: Started in network mode [ 1203.401782][T16758] tipc: Node identity ac1414aa, cluster identity 4711 [ 1203.402558][T16758] tipc: New replicast peer: 172.20.20.187 [ 1203.406352][T16758] tipc: Enabled bearer , priority 10 [ 1203.451183][ T31] audit: type=1400 audit(1789345278.267:401): avc: denied { watch } for pid=16793 comm="syz.3.3014" path="/9/net_prio.prioidx" dev="tmpfs" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1203.520004][T16642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1203.542433][T16642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1203.654510][T16642] team0: Port device team_slave_0 added [ 1203.664597][T16642] team0: Port device team_slave_1 added [ 1203.775980][T16642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1203.775996][T16642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1203.776016][T16642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1203.777717][T16642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1203.777754][T16642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1203.777776][T16642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1203.806936][T16800] comedi comedi1: 8255: I/O port conflict (0xcf8,4) [ 1205.121285][T13440] tipc: Node number set to 2886997162 [ 1205.214693][T16642] hsr_slave_0: entered promiscuous mode [ 1205.215426][T16642] hsr_slave_1: entered promiscuous mode [ 1205.219821][T16642] debugfs: 'hsr0' already exists in 'hsr' [ 1205.219839][T16642] Cannot create hsr debugfs directory [ 1205.322148][ T31] kauditd_printk_skb: 7 callbacks suppressed [ 1205.322166][ T31] audit: type=1400 audit(1789345280.137:409): avc: denied { write } for pid=16802 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1205.436840][ T181] IPVS: stop unused estimator thread 0... [ 1205.441228][T16824] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1205.442298][T16824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.442649][T16824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1205.464288][ T31] audit: type=1400 audit(1789345280.287:410): avc: denied { mount } for pid=16821 comm="syz.1.3020" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1205.485465][ T31] audit: type=1400 audit(1789345280.307:411): avc: denied { write } for pid=16828 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1205.544005][T16832] FAULT_INJECTION: forcing a failure. [ 1205.544005][T16832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1205.544033][T16832] CPU: 1 UID: 0 PID: 16832 Comm: syz.0.3021 Not tainted syzkaller #0 PREEMPT(full) [ 1205.544054][T16832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1205.544065][T16832] Call Trace: [ 1205.544072][T16832] [ 1205.544080][T16832] dump_stack_lvl+0x100/0x190 [ 1205.544111][T16832] should_fail_ex.cold+0x5/0xa [ 1205.544137][T16832] _copy_to_user+0x32/0xd0 [ 1205.544160][T16832] simple_read_from_buffer+0xcb/0x170 [ 1205.544184][T16832] proc_fail_nth_read+0x1af/0x230 [ 1205.544209][T16832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1205.544233][T16832] ? rw_verify_area+0xce/0x6d0 [ 1205.544259][T16832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1205.544280][T16832] vfs_read+0x1e4/0xb40 [ 1205.544298][T16832] ? lock_acquire+0x1d1/0x380 [ 1205.544317][T16832] ? __fget_files+0x34/0x3d0 [ 1205.544339][T16832] ? __pfx_vfs_read+0x10/0x10 [ 1205.544355][T16832] ? find_held_lock+0x2b/0x80 [ 1205.544381][T16832] ? __fget_files+0x215/0x3d0 [ 1205.544408][T16832] ? __fget_files+0x21f/0x3d0 [ 1205.544437][T16832] ksys_read+0x12a/0x250 [ 1205.544455][T16832] ? __pfx_ksys_read+0x10/0x10 [ 1205.544484][T16832] do_syscall_64+0x123/0x790 [ 1205.544511][T16832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.544531][T16832] RIP: 0033:0x7fa3d815e98e [ 1205.544546][T16832] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1205.544563][T16832] RSP: 002b:00007fa3d8fa8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1205.544582][T16832] RAX: ffffffffffffffda RBX: 00007fa3d8fa96c0 RCX: 00007fa3d815e98e [ 1205.544595][T16832] RDX: 000000000000000f RSI: 00007fa3d8fa90a0 RDI: 0000000000000004 [ 1205.544606][T16832] RBP: 00007fa3d8fa9090 R08: 0000000000000000 R09: 0000000000000000 [ 1205.544617][T16832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1205.544628][T16832] R13: 00007fa3d8426038 R14: 00007fa3d8425fa0 R15: 00007fff9d759fa8 [ 1205.544651][T16832] [ 1205.544656][ T31] audit: type=1400 audit(1789345280.357:412): avc: denied { mount } for pid=16831 comm="syz.0.3021" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1205.560254][ T31] audit: type=1400 audit(1789345280.377:413): avc: denied { create } for pid=16821 comm="syz.1.3020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1205.694614][ T31] audit: type=1400 audit(1789345280.517:414): avc: denied { write } for pid=16821 comm="syz.1.3020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1205.870788][ T31] audit: type=1400 audit(1789345280.687:415): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1205.938329][ T31] audit: type=1400 audit(1789345280.757:416): avc: denied { setopt } for pid=16821 comm="syz.1.3020" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1206.182390][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1206.205914][T16841] bridge0: port 3(team0) entered blocking state [ 1206.208206][T16841] bridge0: port 3(team0) entered disabled state [ 1206.210223][T16841] team0: entered allmulticast mode [ 1206.210239][T16841] team_slave_0: entered allmulticast mode [ 1206.210266][T16841] team_slave_1: entered allmulticast mode [ 1206.263965][T16841] team0: entered promiscuous mode [ 1206.263982][T16841] team_slave_0: entered promiscuous mode [ 1206.264090][T16841] team_slave_1: entered promiscuous mode [ 1206.266511][T16841] bridge0: port 3(team0) entered blocking state [ 1206.266577][T16841] bridge0: port 3(team0) entered forwarding state [ 1206.516662][ T31] audit: type=1400 audit(1789345281.337:417): avc: denied { unmount } for pid=5596 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1207.010449][T16857] FAULT_INJECTION: forcing a failure. [ 1207.010449][T16857] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1207.010478][T16857] CPU: 1 UID: 0 PID: 16857 Comm: syz.0.3025 Not tainted syzkaller #0 PREEMPT(full) [ 1207.010499][T16857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1207.010511][T16857] Call Trace: [ 1207.010517][T16857] [ 1207.010526][T16857] dump_stack_lvl+0x100/0x190 [ 1207.010558][T16857] should_fail_ex.cold+0x5/0xa [ 1207.010585][T16857] _copy_to_user+0x32/0xd0 [ 1207.010607][T16857] simple_read_from_buffer+0xcb/0x170 [ 1207.010632][T16857] proc_fail_nth_read+0x1af/0x230 [ 1207.010657][T16857] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1207.010680][T16857] ? rw_verify_area+0xce/0x6d0 [ 1207.010704][T16857] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1207.010726][T16857] vfs_read+0x1e4/0xb40 [ 1207.010751][T16857] ? lock_acquire+0x1d1/0x380 [ 1207.010769][T16857] ? __fget_files+0x34/0x3d0 [ 1207.010791][T16857] ? __pfx_vfs_read+0x10/0x10 [ 1207.010807][T16857] ? find_held_lock+0x2b/0x80 [ 1207.010832][T16857] ? __fget_files+0x215/0x3d0 [ 1207.010857][T16857] ? __fget_files+0x21f/0x3d0 [ 1207.010886][T16857] ksys_read+0x12a/0x250 [ 1207.010904][T16857] ? __pfx_ksys_read+0x10/0x10 [ 1207.010929][T16857] do_syscall_64+0x123/0x790 [ 1207.010957][T16857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1207.010975][T16857] RIP: 0033:0x7fa3d815e98e [ 1207.010991][T16857] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1207.011008][T16857] RSP: 002b:00007fa3d8fa8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1207.011027][T16857] RAX: ffffffffffffffda RBX: 00007fa3d8fa96c0 RCX: 00007fa3d815e98e [ 1207.011039][T16857] RDX: 000000000000000f RSI: 00007fa3d8fa90a0 RDI: 0000000000000004 [ 1207.011050][T16857] RBP: 00007fa3d8fa9090 R08: 0000000000000000 R09: 0000000000000000 [ 1207.011061][T16857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1207.011072][T16857] R13: 00007fa3d8426038 R14: 00007fa3d8425fa0 R15: 00007fff9d759fa8 [ 1207.011098][T16857] [ 1207.076119][ T31] audit: type=1400 audit(1789345281.897:418): avc: denied { write } for pid=16844 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1207.267351][T16848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3024'. [ 1208.029782][T16865] syz.0.3026 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1208.030619][T16865] CPU: 0 UID: 0 PID: 16865 Comm: syz.0.3026 Not tainted syzkaller #0 PREEMPT(full) [ 1208.030647][T16865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1208.030659][T16865] Call Trace: [ 1208.030666][T16865] [ 1208.030675][T16865] dump_stack_lvl+0x100/0x190 [ 1208.030709][T16865] dump_header+0xfb/0x606 [ 1208.030739][T16865] oom_kill_process.cold+0xd/0x380 [ 1208.030765][T16865] out_of_memory+0x340/0x14f0 [ 1208.030797][T16865] ? __pfx_out_of_memory+0x10/0x10 [ 1208.030830][T16865] mem_cgroup_out_of_memory+0xc6/0x130 [ 1208.030856][T16865] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1208.030878][T16865] ? find_held_lock+0x2b/0x80 [ 1208.030912][T16865] ? do_raw_spin_unlock+0x145/0x1e0 [ 1208.030936][T16865] ? _raw_spin_unlock+0x28/0x50 [ 1208.030962][T16865] try_charge_memcg+0x783/0xf60 [ 1208.030995][T16865] ? __pfx_try_charge_memcg+0x10/0x10 [ 1208.031022][T16865] ? find_held_lock+0x2b/0x80 [ 1208.031049][T16865] ? rcu_read_unlock+0x17/0x60 [ 1208.031076][T16865] ? rcu_read_unlock+0x17/0x60 [ 1208.031105][T16865] ? find_held_lock+0x2b/0x80 [ 1208.031132][T16865] ? rcu_read_unlock+0x17/0x60 [ 1208.031166][T16865] charge_memcg+0x1ae/0x210 [ 1208.031196][T16865] __mem_cgroup_charge+0x2b/0x1c0 [ 1208.031226][T16865] do_anonymous_page+0xaf1/0x2050 [ 1208.031262][T16865] ? __pfx_do_anonymous_page+0x10/0x10 [ 1208.031288][T16865] ? rcu_read_unlock+0x2d/0xb0 [ 1208.031314][T16865] ? rcu_read_unlock+0x2d/0xb0 [ 1208.031343][T16865] ? __pte_offset_map+0x179/0x310 [ 1208.031368][T16865] __handle_mm_fault+0x1ff3/0x2f60 [ 1208.031399][T16865] ? lock_vma_under_rcu+0x11d/0x590 [ 1208.031426][T16865] ? __pfx___handle_mm_fault+0x10/0x10 [ 1208.031460][T16865] ? lock_vma_under_rcu+0x17c/0x590 [ 1208.031502][T16865] handle_mm_fault+0x363/0xa20 [ 1208.031535][T16865] do_user_addr_fault+0x59c/0x12f0 [ 1208.031569][T16865] exc_page_fault+0x6f/0xd0 [ 1208.031597][T16865] asm_exc_page_fault+0x26/0x30 [ 1208.031616][T16865] RIP: 0033:0x7fa3d80659e6 [ 1208.031634][T16865] Code: fc ff ff 90 41 57 31 c0 41 56 49 89 fe 48 8d 3d 28 01 1d 00 41 55 49 89 d5 41 54 49 89 f4 48 89 d6 55 53 48 81 ec 88 20 00 00 <48> 89 0c 24 4c 89 44 24 08 e8 cc ca fe ff 4d 85 ed 0f 84 2b 0a 00 [ 1208.031652][T16865] RSP: 002b:00007fa3d8f85f60 EFLAGS: 00010206 [ 1208.031670][T16865] RAX: 0000000000000000 RBX: 00007fa3d8426090 RCX: 0000000000000000 [ 1208.031682][T16865] RDX: 0000200000000040 RSI: 0000200000000040 RDI: 00007fa3d8235af8 [ 1208.031695][T16865] RBP: 00007fa3d823503b R08: 00007fa3d8052850 R09: 0000000000000000 [ 1208.031726][T16865] R10: 0000000000000000 R11: 0000200000000040 R12: 0000000000000036 [ 1208.031739][T16865] R13: 0000200000000040 R14: 0000000000000000 R15: 00007fff9d759fa8 [ 1208.031768][T16865] [ 1208.237527][T16865] memory: usage 4kB, limit 4kB, failcnt 1735 [ 1208.252138][T16865] memory+swap: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1208.252163][T16865] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 1208.252204][T16865] Memory cgroup stats for /syz0/syz2: [ 1208.326306][T16865] cache 0 [ 1208.336268][T16865] rss 0 [ 1208.345913][T16865] rss_huge 0 [ 1208.345926][T16865] shmem 0 [ 1208.346079][T16865] mapped_file 0 [ 1208.360453][T16865] dirty 0 [ 1208.360476][T16865] writeback 0 [ 1208.362629][T16865] workingset_refault_anon 16 [ 1208.371463][T16865] workingset_refault_file 0 [ 1208.371475][T16865] swap 0 [ 1208.382562][T16865] swapcached 172032 [ 1208.382575][T16865] pgpgin 43 [ 1208.486772][T16865] pgpgout 43 [ 1208.486812][T16865] pgfault 4936 [ 1208.486820][T16865] pgmajfault 16 [ 1208.486827][T16865] inactive_anon 0 [ 1208.486860][T16865] active_anon 0 [ 1208.486868][T16865] inactive_file 0 [ 1208.486876][T16865] active_file 0 [ 1208.486908][T16865] unevictable 0 [ 1208.486940][T16865] hierarchical_memory_limit 4096 [ 1208.486993][T16865] hierarchical_memsw_limit 9223372036854771712 [ 1208.487002][T16865] total_cache 0 [ 1208.487009][T16865] total_rss 0 [ 1208.487043][T16865] total_rss_huge 0 [ 1208.487076][T16865] total_shmem 0 [ 1208.487129][T16865] total_mapped_file 0 [ 1208.487181][T16865] total_dirty 0 [ 1208.487213][T16865] total_writeback 0 [ 1208.487267][T16865] total_workingset_refault_anon 16 [ 1208.487327][T16865] total_workingset_refault_file 0 [ 1208.496077][T16865] total_swap 0 [ 1208.496088][T16865] total_swapcached 172032 [ 1208.499899][T16865] total_pgpgin 43 [ 1208.499932][T16865] total_pgpgout 43 [ 1208.499967][T16865] total_pgfault 4936 [ 1208.499976][T16865] total_pgmajfault 16 [ 1208.499984][T16865] total_inactive_anon 0 [ 1208.499992][T16865] total_active_anon 0 [ 1208.500022][T16865] total_inactive_file 0 [ 1208.500054][T16865] total_active_file 0 [ 1208.500087][T16865] total_unevictable 0 [ 1208.500145][T16865] anon_cost 0 [ 1208.500177][T16865] file_cost 0 [ 1208.500211][T16865] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/syz2,task_memcg=/syz0/syz2,task=syz.0.3026,pid=16860,uid=0 [ 1208.539460][T16865] Memory cgroup out of memory: Killed process 16860 (syz.0.3026) total-vm:102516kB, anon-rss:1456kB, file-rss:22688kB, shmem-rss:0kB, UID:0 pgtables:152kB oom_score_adj:1000 [ 1209.794166][T16875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1209.794708][T16875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1210.030938][T16880] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1210.281749][T16642] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1210.295746][T16642] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1210.296375][T16642] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1210.302577][T16642] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1210.304273][T16642] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1210.341870][T16642] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1210.346713][T16642] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1210.361069][T16642] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1210.488336][T14108] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1210.527047][T16642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1210.565590][T16642] 8021q: adding VLAN 0 to HW filter on device team0 [ 1210.578495][T12490] bridge0: port 1(bridge_slave_0) entered blocking state [ 1210.578589][T12490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1210.589969][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 1210.590074][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1210.637567][T14108] usb 4-1: New USB device found, idVendor=093a, idProduct=050f, bcdDevice= 2.6d [ 1210.638954][T14108] usb 4-1: config 4 has an invalid interface number: 122 but max is 0 [ 1210.638978][T14108] usb 4-1: config 4 has no interface number 0 [ 1210.639002][T14108] usb 4-1: too many endpoints for config 4 interface 122 altsetting 16: 59, using maximum allowed: 30 [ 1210.639035][T14108] usb 4-1: config 4 interface 122 altsetting 16 has 0 endpoint descriptors, different from the interface descriptor's value: 59 [ 1210.639060][T14108] usb 4-1: config 4 interface 122 has no altsetting 0 [ 1210.640836][T14108] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1210.640859][T14108] usb 4-1: Product: syz [ 1210.640873][T14108] usb 4-1: Manufacturer: syz [ 1210.640887][T14108] usb 4-1: SerialNumber: syz [ 1210.739960][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 1210.739977][ T31] audit: type=1400 audit(1789345285.557:423): avc: denied { write } for pid=16883 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1210.876112][T16910] nfs: Unknown parameter 'ÿ' [ 1210.945276][ T31] audit: type=1400 audit(1789345285.767:424): avc: denied { write } for pid=16909 comm="syz.2.3032" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 1210.945501][ T31] audit: type=1400 audit(1789345285.767:425): avc: denied { open } for pid=16909 comm="syz.2.3032" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 1210.978874][ T31] audit: type=1400 audit(1789345285.777:426): avc: denied { ioctl } for pid=16909 comm="syz.2.3032" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 1211.031048][ T31] audit: type=1400 audit(1789345285.827:427): avc: denied { write } for pid=16912 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1211.063193][T14108] gspca_main: mars-2.14.0 probing 093a:050f [ 1211.086923][T14108] usb 4-1: USB disconnect, device number 4 [ 1211.175393][T16919] fuse: Unknown parameter 'fd­¸òÂ6LÌ¥~/æ½›-õFPâ4Pı‹Ó¦€;u†ú0x0000000000000005' [ 1211.591581][T16642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1211.937736][ T31] audit: type=1326 audit(1789345286.757:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16950 comm="syz.2.3036" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5cc4d9e159 code=0x0 [ 1211.973591][ T31] audit: type=1400 audit(1789345286.797:429): avc: denied { write } for pid=16925 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1212.041384][ T31] audit: type=1400 audit(1789345286.857:430): avc: denied { unmount } for pid=16217 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1212.064879][ T31] audit: type=1400 audit(1789345286.867:431): avc: denied { node_bind } for pid=16950 comm="syz.2.3036" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 1212.174397][ T31] audit: type=1400 audit(1789345286.997:432): avc: denied { write } for pid=16960 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1212.397894][T16642] veth0_vlan: entered promiscuous mode [ 1212.426543][T16642] veth1_vlan: entered promiscuous mode [ 1212.502108][T16642] veth0_macvtap: entered promiscuous mode [ 1212.516608][T16642] veth1_macvtap: entered promiscuous mode [ 1212.544701][T16642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1212.552624][T16961] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3038'. [ 1212.698917][T16961] vlan3: entered promiscuous mode [ 1212.713343][T16642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1212.751604][ T43] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.751767][ T43] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.751809][ T43] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.751838][ T43] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.251857][T12490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1213.251877][T12490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1213.349246][ T7035] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1213.349261][ T7035] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1216.431018][T17014] FAULT_INJECTION: forcing a failure. [ 1216.431018][T17014] name failslab, interval 1, probability 0, space 0, times 1 [ 1216.431048][T17014] CPU: 1 UID: 0 PID: 17014 Comm: syz.4.2985 Not tainted syzkaller #0 PREEMPT(full) [ 1216.431070][T17014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1216.431081][T17014] Call Trace: [ 1216.431088][T17014] [ 1216.431096][T17014] dump_stack_lvl+0x100/0x190 [ 1216.431130][T17014] should_fail_ex.cold+0x5/0xa [ 1216.431157][T17014] should_failslab+0xc2/0x120 [ 1216.431181][T17014] __kmalloc_cache_noprof+0x91/0x6d0 [ 1216.431207][T17014] ? __fget_files+0x34/0x3d0 [ 1216.431230][T17014] ? bpf_nf_link_attach+0x30d/0xc10 [ 1216.431262][T17014] bpf_nf_link_attach+0x30d/0xc10 [ 1216.431291][T17014] ? __pfx_bpf_nf_link_attach+0x10/0x10 [ 1216.431320][T17014] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1216.431347][T17014] __sys_bpf+0x3f98/0x4a30 [ 1216.431372][T17014] ? __pfx___sys_bpf+0x10/0x10 [ 1216.431389][T17014] ? find_held_lock+0x2b/0x80 [ 1216.431414][T17014] ? get_pid_task+0xfc/0x250 [ 1216.431438][T17014] ? get_pid_task+0xfc/0x250 [ 1216.431470][T17014] ? find_held_lock+0x2b/0x80 [ 1216.431501][T17014] ? rcu_read_lock_any_held+0x6a/0x90 [ 1216.431528][T17014] ? find_held_lock+0x2b/0x80 [ 1216.431552][T17014] ? ksys_write+0x190/0x250 [ 1216.431582][T17014] ? ksys_write+0x190/0x250 [ 1216.431605][T17014] ? lock_acquire+0x1d1/0x380 [ 1216.431641][T17014] ? fput+0x7c/0x100 [ 1216.431664][T17014] ? ksys_write+0x1ac/0x250 [ 1216.431685][T17014] ? __x64_sys_bpf+0xce/0x140 [ 1216.431702][T17014] __x64_sys_bpf+0xce/0x140 [ 1216.431721][T17014] ? do_syscall_64+0xae/0x790 [ 1216.431747][T17014] do_syscall_64+0x123/0x790 [ 1216.431773][T17014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1216.431792][T17014] RIP: 0033:0x7f8c3df9e159 [ 1216.431808][T17014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1216.431825][T17014] RSP: 002b:00007f8c3ed9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1216.431844][T17014] RAX: ffffffffffffffda RBX: 00007f8c3e225fa0 RCX: 00007f8c3df9e159 [ 1216.431856][T17014] RDX: 0000000000000020 RSI: 0000200000000080 RDI: 000000000000001c [ 1216.431868][T17014] RBP: 00007f8c3ed9d090 R08: 0000000000000000 R09: 0000000000000000 [ 1216.431880][T17014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1216.431891][T17014] R13: 00007f8c3e226038 R14: 00007f8c3e225fa0 R15: 00007fff776def78 [ 1216.431917][T17014] [ 1216.706866][ T31] kauditd_printk_skb: 7 callbacks suppressed [ 1216.706884][ T31] audit: type=1400 audit(1789345291.527:440): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1216.769003][ T5695] usb 3-1: USB disconnect, device number 3 [ 1216.890902][T14108] usb 1-1: USB disconnect, device number 2 [ 1216.968846][ T31] audit: type=1400 audit(1789345291.787:441): avc: denied { write } for pid=16999 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1217.054729][ T5602] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1217.060488][ T5602] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1217.061034][ T5602] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1217.061690][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1217.062592][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1217.232194][ T31] audit: type=1400 audit(1789345292.047:442): avc: denied { name_bind } for pid=17028 comm="syz.1.3049" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 1217.314512][ T31] audit: type=1400 audit(1789345292.137:443): avc: denied { write } for pid=17029 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1217.723571][T17035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1217.723895][T17035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1217.726524][T17040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1217.731536][T17040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1217.840482][ T31] audit: type=1400 audit(1789345292.657:444): avc: denied { create } for pid=17034 comm="syz.3.3052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1218.038875][ T148] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.129971][ T148] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.219924][ T148] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.306695][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1218.311699][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1218.312519][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1218.315775][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1218.317659][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1218.391627][T17060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1218.392012][T17060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1218.417744][ T148] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.540364][T17063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3056'. [ 1218.547075][T17063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3056'. [ 1218.548388][T17063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3056'. [ 1218.572366][T17063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3056'. [ 1218.603093][ T31] audit: type=1400 audit(1789345293.417:445): avc: denied { create } for pid=17059 comm="syz.1.3056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1218.609977][ T31] audit: type=1400 audit(1789345293.427:446): avc: denied { bind } for pid=17059 comm="syz.1.3056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1218.615851][ T31] audit: type=1400 audit(1789345293.437:447): avc: denied { setopt } for pid=17059 comm="syz.1.3056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1218.626855][ T31] audit: type=1400 audit(1789345293.447:448): avc: denied { accept } for pid=17059 comm="syz.1.3056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1218.694426][ T31] audit: type=1400 audit(1789345293.517:449): avc: denied { write } for pid=17059 comm="syz.1.3056" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1219.144778][ T5609] Bluetooth: hci2: command tx timeout [ 1219.785895][T17066] 9p: Bad value for 'wfdno' [ 1220.422992][ T5609] Bluetooth: hci3: command tx timeout [ 1220.755667][T17071] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17071 comm=syz.4.3058 [ 1220.917698][ T148] team0: left allmulticast mode [ 1220.917713][ T148] team_slave_0: left allmulticast mode [ 1220.917723][ T148] team_slave_1: left allmulticast mode [ 1220.922246][ T148] team0: left promiscuous mode [ 1220.922259][ T148] team_slave_0: left promiscuous mode [ 1220.922355][ T148] team_slave_1: left promiscuous mode [ 1220.922538][ T148] bridge0: port 3(team0) entered disabled state [ 1220.935551][ T148] bridge_slave_1: left allmulticast mode [ 1220.935570][ T148] bridge_slave_1: left promiscuous mode [ 1220.935707][ T148] bridge0: port 2(bridge_slave_1) entered disabled state [ 1220.943157][T14108] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 1220.945423][ T148] bridge_slave_0: left allmulticast mode [ 1220.945440][ T148] bridge_slave_0: left promiscuous mode [ 1220.945580][ T148] bridge0: port 1(bridge_slave_0) entered disabled state [ 1221.092922][T14108] usb 4-1: Using ep0 maxpacket: 8 [ 1221.094542][T14108] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1221.094927][T14108] usb 4-1: config 0 has no interfaces? [ 1221.096341][T14108] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1221.096354][T14108] usb 4-1: Product: syz [ 1221.096364][T14108] usb 4-1: Manufacturer: syz [ 1221.096372][T14108] usb 4-1: SerialNumber: syz [ 1221.099911][T14108] usb 4-1: config 0 descriptor?? [ 1221.232915][ T5609] Bluetooth: hci2: command tx timeout [ 1221.316046][T17086] FAULT_INJECTION: forcing a failure. [ 1221.316046][T17086] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1221.316066][T17086] CPU: 0 UID: 0 PID: 17086 Comm: syz.1.3060 Not tainted syzkaller #0 PREEMPT(full) [ 1221.316079][T17086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1221.316087][T17086] Call Trace: [ 1221.316091][T17086] [ 1221.316096][T17086] dump_stack_lvl+0x100/0x190 [ 1221.316116][T17086] should_fail_ex.cold+0x5/0xa [ 1221.316132][T17086] _copy_from_user+0x2e/0xd0 [ 1221.316145][T17086] user_termios_to_kernel_termios_1+0x21/0x30 [ 1221.316165][T17086] set_termios+0x3c0/0x880 [ 1221.316184][T17086] ? __pfx_set_termios+0x10/0x10 [ 1221.316200][T17086] ? __lock_acquire+0x5c0/0x1f40 [ 1221.316215][T17086] ? avc_has_extended_perms+0x484/0x1080 [ 1221.316234][T17086] ? lock_acquire+0x1d1/0x380 [ 1221.316247][T17086] tty_mode_ioctl+0x17e/0xd40 [ 1221.316264][T17086] ? kasan_quarantine_put+0x104/0x240 [ 1221.316278][T17086] ? __pfx_tty_mode_ioctl+0x10/0x10 [ 1221.316299][T17086] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 1221.316319][T17086] ? __pfx_n_tty_ioctl+0x10/0x10 [ 1221.316333][T17086] n_tty_ioctl_helper+0x47/0x2b0 [ 1221.316351][T17086] n_tty_ioctl+0x53/0x340 [ 1221.316367][T17086] ? __pfx_n_tty_ioctl+0x10/0x10 [ 1221.316381][T17086] tty_ioctl+0x11b4/0x1640 [ 1221.316395][T17086] ? __pfx_tty_ioctl+0x10/0x10 [ 1221.316407][T17086] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 1221.316424][T17086] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1221.316439][T17086] ? __fget_files+0x34/0x3d0 [ 1221.316459][T17086] ? selinux_file_ioctl+0x13b/0x290 [ 1221.316471][T17086] ? selinux_file_ioctl+0xb6/0x290 [ 1221.316484][T17086] ? __pfx_tty_ioctl+0x10/0x10 [ 1221.316503][T17086] __x64_sys_ioctl+0x18e/0x210 [ 1221.316516][T17086] do_syscall_64+0x123/0x790 [ 1221.316533][T17086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1221.316545][T17086] RIP: 0033:0x7fd946f9e159 [ 1221.316555][T17086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1221.316565][T17086] RSP: 002b:00007fd947e9a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1221.316577][T17086] RAX: ffffffffffffffda RBX: 00007fd947225fa0 RCX: 00007fd946f9e159 [ 1221.316584][T17086] RDX: 0000200000000140 RSI: 0000000000005402 RDI: 0000000000000004 [ 1221.316591][T17086] RBP: 00007fd947e9a090 R08: 0000000000000000 R09: 0000000000000000 [ 1221.316598][T17086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1221.316605][T17086] R13: 00007fd947226038 R14: 00007fd947225fa0 R15: 00007ffffc9b97c8 [ 1221.316619][T17086] [ 1221.366202][ T148] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1221.540882][T17084] comedi comedi1: pcl816: I/O base address not correctly aligned [ 1221.575614][ T148] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1221.629533][ T148] bond0 (unregistering): Released all slaves [ 1221.664556][T17089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1221.664821][T17089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1221.740782][T17022] bridge0: port 1(bridge_slave_0) entered blocking state [ 1221.740827][T17022] bridge0: port 1(bridge_slave_0) entered disabled state [ 1221.740904][T17022] bridge_slave_0: entered allmulticast mode [ 1221.741684][T17022] bridge_slave_0: entered promiscuous mode [ 1221.761991][T17022] bridge0: port 2(bridge_slave_1) entered blocking state [ 1221.762059][T17022] bridge0: port 2(bridge_slave_1) entered disabled state [ 1221.762142][T17022] bridge_slave_1: entered allmulticast mode [ 1221.777348][T17022] bridge_slave_1: entered promiscuous mode [ 1222.149062][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 1222.149080][ T31] audit: type=1400 audit(1789345296.967:458): avc: denied { shutdown } for pid=17096 comm="syz.4.3062" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1222.152066][ T31] audit: type=1400 audit(1789345296.967:459): avc: denied { read } for pid=17096 comm="syz.4.3062" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1222.227936][T17022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1222.320002][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.334283][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.335675][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.335796][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.341816][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.342008][T17097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 1222.447836][T17022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1222.503430][ T5609] Bluetooth: hci3: command tx timeout [ 1222.694515][T17089] mmap: syz.1.3061 (17089) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1222.933767][ T31] audit: type=1400 audit(1789345297.757:460): avc: denied { write } for pid=17105 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1223.007432][T17022] team0: Port device team_slave_0 added [ 1223.010969][T17022] team0: Port device team_slave_1 added [ 1223.097894][ T31] audit: type=1400 audit(1789345297.917:461): avc: denied { append } for pid=17118 comm="syz.4.3063" name="cec4" dev="devtmpfs" ino=973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1223.146697][ T31] audit: type=1400 audit(1789345297.967:462): avc: denied { setattr } for pid=17118 comm="syz.4.3063" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1223.182991][T17022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1223.183006][T17022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1223.183026][T17022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1223.188911][ T31] audit: type=1400 audit(1789345298.007:463): avc: denied { write } for pid=17117 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1223.264246][ T148] hsr_slave_0: left promiscuous mode [ 1223.269335][ T148] hsr_slave_1: left promiscuous mode [ 1223.270019][ T148] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1223.270035][ T148] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1223.276894][ T148] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1223.276910][ T148] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1223.296553][T13440] usb 4-1: USB disconnect, device number 5 [ 1223.307994][ T5609] Bluetooth: hci2: command tx timeout [ 1223.355290][ T148] veth1_macvtap: left promiscuous mode [ 1223.355322][ T148] veth0_macvtap: left promiscuous mode [ 1223.355403][ T148] veth1_vlan: left promiscuous mode [ 1223.355543][ T148] veth0_vlan: left promiscuous mode [ 1223.458267][ T31] audit: type=1800 audit(1789345298.277:464): pid=17119 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.4.3063" name="/dri/renderD128" dev="devtmpfs" ino=626 res=0 errno=0 [ 1223.678355][ T31] audit: type=1400 audit(1789345298.497:465): avc: denied { ioctl } for pid=17124 comm="syz.4.3065" path="socket:[51104]" dev="sockfs" ino=51104 ioctlcmd=0x6e8c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1224.223031][ T31] audit: type=1400 audit(1789345299.017:466): avc: denied { read } for pid=17133 comm="syz.3.3064" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1224.583534][ T5609] Bluetooth: hci3: command tx timeout [ 1225.385026][ T5609] Bluetooth: hci2: command tx timeout [ 1225.970110][ T148] team0 (unregistering): Port device team_slave_1 removed [ 1225.997965][ T148] team0 (unregistering): Port device team_slave_0 removed [ 1226.158543][T17022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1226.158555][T17022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1226.158569][T17022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1226.211735][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1226.486311][T17144] warn_alloc: 1 callbacks suppressed [ 1226.486335][T17144] syz.1.3068: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1226.486493][T17144] CPU: 1 UID: 0 PID: 17144 Comm: syz.1.3068 Not tainted syzkaller #0 PREEMPT(full) [ 1226.486516][T17144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1226.486528][T17144] Call Trace: [ 1226.486536][T17144] [ 1226.486546][T17144] dump_stack_lvl+0x100/0x190 [ 1226.486582][T17144] warn_alloc.cold+0x9e/0xb2 [ 1226.486606][T17144] ? __pfx_warn_alloc+0x10/0x10 [ 1226.486643][T17144] ? avc_has_extended_perms+0x201/0x1080 [ 1226.486674][T17144] ? avc_has_extended_perms+0x33a/0x1080 [ 1226.486701][T17144] ? avc_has_extended_perms+0x33a/0x1080 [ 1226.486738][T17144] __vmalloc_node_range_noprof+0x123b/0x1420 [ 1226.486767][T17144] ? rcu_is_watching+0x13/0xc0 [ 1226.486793][T17144] ? trace_contention_end+0x126/0x160 [ 1226.486820][T17144] ? dvb_demux_do_ioctl+0x929/0x1200 [ 1226.486840][T17144] ? kasan_quarantine_put+0x104/0x240 [ 1226.486862][T17144] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1226.486886][T17144] ? __pfx___mutex_lock+0x10/0x10 [ 1226.486914][T17144] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1226.486944][T17144] ? tomoyo_path_number_perm+0x188/0x580 [ 1226.486968][T17144] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1226.486987][T17144] __vmalloc_node_noprof+0xad/0xf0 [ 1226.487009][T17144] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1226.487031][T17144] dvb_demux_do_ioctl+0x9e0/0x1200 [ 1226.487052][T17144] ? do_vfs_ioctl+0x226/0x13e0 [ 1226.487075][T17144] dvb_usercopy+0x167/0x340 [ 1226.487102][T17144] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1226.487124][T17144] ? __pfx_dvb_usercopy+0x10/0x10 [ 1226.487163][T17144] ? selinux_file_ioctl+0x13b/0x290 [ 1226.487185][T17144] ? selinux_file_ioctl+0xb6/0x290 [ 1226.487210][T17144] dvb_demux_ioctl+0x29/0x40 [ 1226.487238][T17144] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1226.487269][T17144] __x64_sys_ioctl+0x18e/0x210 [ 1226.487291][T17144] do_syscall_64+0x123/0x790 [ 1226.487320][T17144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.487341][T17144] RIP: 0033:0x7fd946f9e159 [ 1226.487359][T17144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.487378][T17144] RSP: 002b:00007fd947e79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1226.487398][T17144] RAX: ffffffffffffffda RBX: 00007fd947226090 RCX: 00007fd946f9e159 [ 1226.487419][T17144] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 000000000000000a [ 1226.487433][T17144] RBP: 00007fd94703503b R08: 0000000000000000 R09: 0000000000000000 [ 1226.487446][T17144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1226.487458][T17144] R13: 00007fd947226128 R14: 00007fd947226090 R15: 00007ffffc9b97c8 [ 1226.487489][T17144] [ 1226.487528][T17144] Mem-Info: [ 1226.487570][T17144] active_anon:31719 inactive_anon:0 isolated_anon:0 [ 1226.487570][T17144] active_file:0 inactive_file:58619 isolated_file:0 [ 1226.487570][T17144] unevictable:0 dirty:604 writeback:0 [ 1226.487570][T17144] slab_reclaimable:12794 slab_unreclaimable:99221 [ 1226.487570][T17144] mapped:47011 shmem:24003 pagetables:1497 [ 1226.487570][T17144] sec_pagetables:0 bounce:0 [ 1226.487570][T17144] kernel_misc_reclaimable:0 [ 1226.487570][T17144] free:1270917 free_pcp:14404 free_cma:0 [ 1226.487626][T17144] Node 0 active_anon:124828kB inactive_anon:0kB active_file:0kB inactive_file:234220kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:188028kB dirty:2416kB writeback:0kB shmem:93964kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12632kB pagetables:5848kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1226.487701][T17144] Node 1 active_anon:2048kB inactive_anon:0kB active_file:0kB inactive_file:256kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:16kB dirty:0kB writeback:0kB shmem:2048kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1226.487761][T17144] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1226.487865][T17144] lowmem_reserve[]: 0 2471 2471 2471 2471 [ 1226.488048][T17144] Node 0 DMA32 free:1129424kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:124828kB inactive_anon:0kB active_file:0kB inactive_file:234220kB unevictable:0kB writepending:2416kB zspages:0kB present:3129332kB managed:2530536kB mlocked:0kB bounce:0kB free_pcp:48152kB local_pcp:10016kB free_cma:0kB [ 1226.488180][T17144] lowmem_reserve[]: 0 0 0 0 0 [ 1226.488356][T17144] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1226.488512][T17144] lowmem_reserve[]: 0 0 0 0 0 [ 1226.488676][T17144] Node 1 Normal free:3938884kB boost:0kB min:55908kB low:69884kB high:83860kB reserved_highatomic:0kB free_highatomic:0kB active_anon:2048kB inactive_anon:0kB active_file:0kB inactive_file:256kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:9464kB local_pcp:4784kB free_cma:0kB [ 1226.488791][T17144] lowmem_reserve[]: 0 0 0 0 0 [ 1226.488998][T17144] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1226.489557][T17144] Node 0 DMA32: 23*4kB (UM) 23*8kB (U) 28*16kB (UE) 255*32kB (UE) 90*64kB (U) 41*128kB (U) 16*256kB (UME) 9*512kB (UME) 3*1024kB (UM) 2*2048kB (M) 267*4096kB (UM) = 1129396kB [ 1226.490600][T17144] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1226.491132][T17144] Node 1 Normal: 5*4kB (UM) 2*8kB (UM) 2*16kB (M) 4*32kB (UM) 4*64kB (UM) 5*128kB (UM) 6*256kB (UM) 6*512kB (UM) 1*1024kB (M) 2*2048kB (UM) 959*4096kB (M) = 3938884kB [ 1226.492256][T17144] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1226.492291][T17144] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1226.492343][T17144] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1226.492384][T17144] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1226.492429][T17144] 82614 total pagecache pages [ 1226.492469][T17144] 0 pages in swap cache [ 1226.492507][T17144] Free swap = 124996kB [ 1226.492545][T17144] Total swap = 124996kB [ 1226.492584][T17144] 2097051 pages RAM [ 1226.492622][T17144] 0 pages HighMem/MovableOnly [ 1226.492661][T17144] 432783 pages reserved [ 1226.492699][T17144] 0 pages cma reserved [ 1226.549992][T17022] hsr_slave_0: entered promiscuous mode [ 1226.568460][T17022] hsr_slave_1: entered promiscuous mode [ 1226.569033][T17022] debugfs: 'hsr0' already exists in 'hsr' [ 1226.569048][T17022] Cannot create hsr debugfs directory [ 1226.665704][ T5609] Bluetooth: hci3: command tx timeout [ 1227.872127][ T31] audit: type=1400 audit(1789345302.687:467): avc: denied { listen } for pid=17149 comm="syz.1.3069" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1227.975445][ T31] audit: type=1400 audit(1789345302.797:468): avc: denied { setopt } for pid=17153 comm="syz.3.3070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1227.975490][ T31] audit: type=1400 audit(1789345302.797:469): avc: denied { bind } for pid=17153 comm="syz.3.3070" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1228.033250][ T31] audit: type=1400 audit(1789345302.857:470): avc: denied { name_bind } for pid=17153 comm="syz.3.3070" src=19969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 1228.404236][T17054] bridge0: port 1(bridge_slave_0) entered blocking state [ 1228.412352][T17054] bridge0: port 1(bridge_slave_0) entered disabled state [ 1228.412722][ T31] audit: type=1400 audit(1789345303.227:471): avc: denied { ioctl } for pid=17164 comm="syz.1.3072" path="socket:[51179]" dev="sockfs" ino=51179 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1228.412831][T17054] bridge_slave_0: entered allmulticast mode [ 1228.414611][T17054] bridge_slave_0: entered promiscuous mode [ 1228.416176][T17054] bridge0: port 2(bridge_slave_1) entered blocking state [ 1228.416240][T17054] bridge0: port 2(bridge_slave_1) entered disabled state [ 1228.416318][T17054] bridge_slave_1: entered allmulticast mode [ 1228.417432][T17054] bridge_slave_1: entered promiscuous mode [ 1228.443712][T17168] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1228.445666][T17168] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1229.336263][ T31] audit: type=1400 audit(1789345304.157:472): avc: denied { write } for pid=17147 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1230.033430][T17022] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.375245][T11164] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1230.525729][T11164] usb 4-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 1230.554491][T11164] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 1230.557560][T11164] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1230.557708][T11164] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1230.557735][T11164] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196 [ 1230.557837][T11164] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1230.673172][T11164] usb 4-1: config 0 descriptor?? [ 1230.675980][ T148] IPVS: stop unused estimator thread 0... [ 1230.706824][ T31] audit: type=1400 audit(1789345305.527:473): avc: denied { write } for pid=17176 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1230.723574][T17054] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1230.729228][T17054] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1230.865457][T17022] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1230.892408][T17054] team0: Port device team_slave_0 added [ 1230.907359][T17054] team0: Port device team_slave_1 added [ 1230.935175][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1230.962110][T17054] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1230.962125][T17054] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1230.962145][T17054] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1231.032947][ T5695] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1231.038419][T17022] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.066111][T17054] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1231.066127][T17054] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1231.066148][T17054] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1231.140614][T11164] holtek_kbd 0003:04D9:A055.0063: unbalanced collection at end of report description [ 1231.156219][T11164] holtek_kbd 0003:04D9:A055.0063: probe with driver holtek_kbd failed with error -22 [ 1231.192370][T17022] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.194844][ T5695] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1231.197295][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1231.197315][ T5695] usb 5-1: Product: syz [ 1231.197328][ T5695] usb 5-1: Manufacturer: syz [ 1231.197340][ T5695] usb 5-1: SerialNumber: syz [ 1231.279481][T17054] hsr_slave_0: entered promiscuous mode [ 1231.279957][T17054] hsr_slave_1: entered promiscuous mode [ 1231.280291][T17054] debugfs: 'hsr0' already exists in 'hsr' [ 1231.280304][T17054] Cannot create hsr debugfs directory [ 1231.327670][T17175] capability: warning: `syz.3.3073' uses 32-bit capabilities (legacy support in use) [ 1231.330077][T11164] usb 4-1: USB disconnect, device number 6 [ 1231.487595][T17178] __nla_validate_parse: 59 callbacks suppressed [ 1231.487608][T17178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3074'. [ 1231.489486][ T148] bridge_slave_1: left allmulticast mode [ 1231.489502][ T148] bridge_slave_1: left promiscuous mode [ 1231.489604][ T148] bridge0: port 2(bridge_slave_1) entered disabled state [ 1231.491985][ T148] bridge_slave_0: left allmulticast mode [ 1231.492006][ T148] bridge_slave_0: left promiscuous mode [ 1231.495219][ T148] bridge0: port 1(bridge_slave_0) entered disabled state [ 1231.497548][T17188] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1231.497894][T17188] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1231.588460][T17190] capability: warning: `syz.1.3075' uses deprecated v2 capabilities in a way that may be insecure [ 1231.737009][ T31] audit: type=1400 audit(1789345306.557:474): avc: denied { write } for pid=17181 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1231.804147][ T148] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1231.807273][ T148] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1231.809922][ T148] bond0 (unregistering): Released all slaves [ 1231.876040][ T5695] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1231.876095][ T5695] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 1231.877016][ T31] audit: type=1400 audit(1789345306.697:475): avc: denied { write } for pid=17197 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1231.877120][ T5695] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 1231.877165][ T5695] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1231.877655][ T5695] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1231.967657][ T5695] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1232.022001][ T5695] usb 5-1: USB disconnect, device number 3 [ 1232.053471][ T148] tipc: Disabling bearer [ 1232.053819][ T148] tipc: Left network mode [ 1232.115205][ T31] audit: type=1400 audit(1789345306.937:476): avc: denied { write } for pid=17199 comm="syz.3.3076" name="001" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1232.155656][ T5261] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1232.495636][T17022] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1232.517927][T17022] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1232.535022][T17022] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1232.575581][T17022] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1232.579129][T17022] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1232.610134][T17022] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1232.656840][ T148] BUG: unable to handle page fault for address: fffffffffffffc10 [ 1232.664570][ T148] #PF: supervisor read access in kernel mode [ 1232.670538][ T148] #PF: error_code(0x0000) - not-present page [ 1232.676503][ T148] PGD eb99067 P4D eb99067 PUD eb9b067 PMD 0 [ 1232.682481][ T148] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 1232.688013][ T148] CPU: 1 UID: 0 PID: 148 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) [ 1232.697369][ T148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1232.707410][ T148] Workqueue: netns cleanup_net [ 1232.712163][ T148] RIP: 0010:strnlen+0x4b/0x80 [ 1232.716829][ T148] Code: 49 89 fc 48 89 f8 eb 09 48 83 c0 01 48 39 e8 74 1e 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 84 d2 75 15 <80> 38 00 75 d9 4c 29 e0 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 [ 1232.736426][ T148] RSP: 0018:ffffc90002e6f1c8 EFLAGS: 00010246 [ 1232.742476][ T148] RAX: fffffffffffffc10 RBX: dffffc0000000000 RCX: 0000000000000000 [ 1232.750429][ T148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: fffffffffffffc10 [ 1232.758380][ T148] RBP: fffffffffffffc20 R08: 0000000000000007 R09: 0000000000000000 [ 1232.766331][ T148] R10: 0000000000000000 R11: 000000000000762b R12: fffffffffffffc10 [ 1232.774285][ T148] R13: ffff88801c68fe00 R14: 0000000000000006 R15: 0000000000000010 [ 1232.782233][ T148] FS: 0000000000000000(0000) GS:ffff888123c59000(0000) knlGS:0000000000000000 [ 1232.791142][ T148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1232.797703][ T148] CR2: fffffffffffffc10 CR3: 000000005334b000 CR4: 00000000003526f0 [ 1232.805657][ T148] Call Trace: [ 1232.808914][ T148] [ 1232.811828][ T148] trace_event_raw_event_drv_net_setup_tc+0x101/0x5d0 [ 1232.818583][ T148] ? __pfx_trace_event_raw_event_drv_net_setup_tc+0x10/0x10 [ 1232.825858][ T148] ? __pfx___might_resched+0x10/0x10 [ 1232.831135][ T148] ieee80211_netdev_setup_tc+0x2c6/0x3e0 [ 1232.836760][ T148] ? __pfx_ieee80211_netdev_setup_tc+0x10/0x10 [ 1232.842898][ T148] tcf_block_offload_cmd.isra.0+0x1c4/0x310 [ 1232.848778][ T148] ? __pfx_tcf_block_offload_cmd.isra.0+0x10/0x10 [ 1232.855179][ T148] ? __pfx_down_write+0x10/0x10 [ 1232.860017][ T148] tcf_block_offload_unbind+0xad/0x170 [ 1232.865453][ T148] __tcf_block_put+0x11a/0x2a0 [ 1232.870195][ T148] tcf_block_put_ext+0xf6/0x1d0 [ 1232.875025][ T148] tcf_block_put+0xb6/0x100 [ 1232.879507][ T148] ? __pfx_tcf_block_put+0x10/0x10 [ 1232.884595][ T148] ? qdisc_reset+0x322/0x670 [ 1232.889166][ T148] ? __pfx_fq_codel_destroy+0x10/0x10 [ 1232.894516][ T148] fq_codel_destroy+0x37/0xb0 [ 1232.899172][ T148] __qdisc_destroy+0x109/0x530 [ 1232.903919][ T148] qdisc_put+0xb0/0xf0 [ 1232.907968][ T148] ? __pfx_netem_destroy+0x10/0x10 [ 1232.913055][ T148] netem_destroy+0x51/0xd0 [ 1232.917450][ T148] __qdisc_destroy+0x109/0x530 [ 1232.922195][ T148] qdisc_put+0xb0/0xf0 [ 1232.926245][ T148] dev_shutdown+0x1d2/0x440 [ 1232.930733][ T148] unregister_netdevice_many_notify+0xd55/0x2150 [ 1232.937045][ T148] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1232.943790][ T148] ? rcu_is_watching+0x13/0xc0 [ 1232.948538][ T148] unregister_netdevice_queue+0x30b/0x3c0 [ 1232.954240][ T148] ? kernfs_remove_by_name_ns+0x103/0x120 [ 1232.959937][ T148] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1232.966159][ T148] _cfg80211_unregister_wdev+0x66e/0x830 [ 1232.971776][ T148] ieee80211_remove_interfaces+0x34e/0x6e0 [ 1232.977564][ T148] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 1232.983873][ T148] ieee80211_unregister_hw+0x55/0x360 [ 1232.989229][ T148] hwsim_exit_net+0x891/0x1500 [ 1232.993978][ T148] ? __pfx_hwsim_exit_net+0x10/0x10 [ 1232.999156][ T148] ? ip_vs_sync_net_cleanup+0x84/0x90 [ 1233.004507][ T148] ? __ip_vs_dev_cleanup_batch+0x21e/0x2a0 [ 1233.010291][ T148] ? __pfx_hwsim_exit_net+0x10/0x10 [ 1233.015482][ T148] ops_undo_list+0x2ee/0xab0 [ 1233.020073][ T148] ? __pfx_ops_undo_list+0x10/0x10 [ 1233.025182][ T148] ? cleanup_net+0x332/0x920 [ 1233.029765][ T148] ? idr_destroy+0x62/0x2e0 [ 1233.034255][ T148] cleanup_net+0x499/0x920 [ 1233.038657][ T148] ? __pfx_cleanup_net+0x10/0x10 [ 1233.043578][ T148] ? process_one_work+0xa2c/0x1b10 [ 1233.048677][ T148] ? process_one_work+0x906/0x1b10 [ 1233.053773][ T148] process_one_work+0xac7/0x1b10 [ 1233.058705][ T148] ? __pfx_process_one_work+0x10/0x10 [ 1233.064063][ T148] ? lock_acquire+0x1d1/0x380 [ 1233.068722][ T148] ? __pfx_cleanup_net+0x10/0x10 [ 1233.073642][ T148] worker_thread+0x5ef/0xe50 [ 1233.078230][ T148] ? kthread+0x13a/0x450 [ 1233.082472][ T148] ? __pfx_worker_thread+0x10/0x10 [ 1233.087581][ T148] kthread+0x373/0x450 [ 1233.091646][ T148] ? __pfx_kthread+0x10/0x10 [ 1233.096227][ T148] ret_from_fork+0x730/0xd60 [ 1233.100801][ T148] ? __pfx_ret_from_fork+0x10/0x10 [ 1233.105897][ T148] ? __switch_to+0x800/0x10f0 [ 1233.110557][ T148] ? __pfx_kthread+0x10/0x10 [ 1233.115131][ T148] ret_from_fork_asm+0x1a/0x30 [ 1233.119878][ T148] [ 1233.122875][ T148] Modules linked in: [ 1233.126748][ T148] CR2: fffffffffffffc10 [ 1233.130879][ T148] ---[ end trace 0000000000000000 ]--- [ 1233.136308][ T148] RIP: 0010:strnlen+0x4b/0x80 [ 1233.136332][ T148] Code: 49 89 fc 48 89 f8 eb 09 48 83 c0 01 48 39 e8 74 1e 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 84 d2 75 15 <80> 38 00 75 d9 4c 29 e0 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 [ 1233.136346][ T148] RSP: 0018:ffffc90002e6f1c8 EFLAGS: 00010246 [ 1233.136358][ T148] RAX: fffffffffffffc10 RBX: dffffc0000000000 RCX: 0000000000000000 [ 1233.136368][ T148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: fffffffffffffc10 [ 1233.136377][ T148] RBP: fffffffffffffc20 R08: 0000000000000007 R09: 0000000000000000 [ 1233.136386][ T148] R10: 0000000000000000 R11: 000000000000762b R12: fffffffffffffc10 [ 1233.136395][ T148] R13: ffff88801c68fe00 R14: 0000000000000006 R15: 0000000000000010 [ 1233.136405][ T148] FS: 0000000000000000(0000) GS:ffff888123c59000(0000) knlGS:0000000000000000 [ 1233.136420][ T148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1233.136429][ T148] CR2: fffffffffffffc10 CR3: 000000005334b000 CR4: 00000000003526f0 [ 1233.136440][ T148] Kernel panic - not syncing: Fatal exception [ 1233.236013][ T148] Kernel Offset: disabled [ 1233.240313][ T148] Rebooting in 86400 seconds..